Mattermost Authorization Bypass Vulnerability in Private Channels

An authorization bypass vulnerability has been identified in Mattermost versions 10.5.x through 10.5.6, 10.8.x through 10.8.1, 10.7.x through 10.7.3, and 9.11.x through 9.11.16. This vulnerability allows authenticated users to access posts in private channels by guessing the PendingPostID of recently created posts. The issue arises because the application fails to properly verify authorization when retrieving cached posts by PendingPostID.

Impact

Exploitation of this vulnerability allows unauthorized access to private channel posts, enabling users to read sensitive information they should not have access to.

Remediation

Users can upgrade to Mattermost versions 10.9.0, 10.8.2, 10.7.4, or 9.11.17 to address this vulnerability.