Mattermost Playbook Run Metadata Channel Membership Validation Vulnerability

A vulnerability exists in Mattermost versions 10.5.x through 10.5.5, 9.11.x through 9.11.15, 10.8.x through 10.8.0, 10.7.x through 10.7.2, and 10.6.x through 10.6.5. The issue arises because these versions do not properly validate channel membership when accessing playbook run metadata. This flaw allows authenticated users who are members of a playbook but not of the channel to retrieve sensitive information about linked private channels, such as the channel name, display name, and participant count, via the run metadata API endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private channel information, including names, display names, and participant counts, for channels linked to playbook runs.