Mattermost Agents Plugin Access Control Vulnerability

A vulnerability exists in the Mattermost Agents plugin for versions 10.11.x through 10.11.3 and 10.5.x through 10.5.11. The issue arises because these versions do not properly enforce access permissions, allowing users to see when others have read channels by accessing channel member objects.

Impact

Exploitation of this vulnerability could lead to unauthorized users gaining insight into channel reading activity of other users, potentially allowing for the inference of user engagement or availability.

Remediation

Users can upgrade to Mattermost versions 11.1.010.11.5 or 11.1.010.11.6 to address this vulnerability.