Mattermost AI-Assisted Message Rewrite Channel Membership Verification Vulnerability

A vulnerability exists in Mattermost versions 11.5.x through 11.5.1, where the application fails to properly verify channel membership during AI-assisted message rewrites. This flaw allows an authenticated attacker to access and read content from threads in private channels and direct messages that they do not have permission to view. The exploitation involves sending a crafted request to the post rewrite endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private channel threads and direct messages, allowing attackers to read sensitive information they should not have access to.

Remediation

Users can upgrade to Mattermost version 11.7.0 to address this vulnerability.