When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.
Solution:
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
| Link | Tags |
|---|---|
| https://mattermost.com/security-updates/ | vendor advisory |