Mattermost API Team Information Exposure Vulnerability for Guest Users

A vulnerability exists in Mattermost versions 10.5.x through 10.5.4 and 9.11.x through 9.11.13, allowing guest users to bypass permissions and access information about public teams they do not belong to. This issue arises from improper restrictions on API access to team data, enabling unauthorized visibility through direct calls to the teams API endpoint.

Impact

Exploitation of this vulnerability allows unauthorized access to team information, potentially leading to privacy violations by disclosing details about public teams that a user is not a member of.

Remediation

Users can upgrade to Mattermost versions 10.9.0 or 10.8.0 to address this vulnerability.