Mattermost Bulk Export Permission Vulnerability Allowing Unauthorized Access to Exported Data

A vulnerability exists in Mattermost versions 11.4.x through 11.4.0, 11.3.x through 11.3.1, 11.2.x through 11.2.3, and 10.11.x through 10.11.11. These versions fail to properly set permissions on downloaded bulk exports, allowing other local users on the server to access the contents of these exports. This issue could lead to unauthorized data exposure.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive data contained in bulk exports, potentially leading to privacy violations or misuse of information.

Remediation

Users can upgrade to Mattermost versions 11.5.0 or 11.6.0 to address this vulnerability.