Mattermost Team Member Data Exposure Vulnerability via API

A vulnerability exists in Mattermost versions 11.6.x through 11.6.0, 11.5.x through 11.5.3, 11.4.x through 11.4.4, and 10.11.x through 10.11.14. These versions fail to properly sanitize team member data when it is returned through the API to users without elevated permissions. This oversight allows users lacking the necessary permissions to access information about team members' roles by invoking various team API endpoints.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive team member role information, potentially allowing users to manipulate team dynamics or permissions based on the acquired data.

Remediation

Users are advised to upgrade to Mattermost versions 11.8.0 or 11.7.18. Instructions for downloading the latest version can be found on the Mattermost website.