Listen to this Post
The vulnerability exists in the `GET /api/v4/channels/{channel_id}/common_teams` API endpoint. When this endpoint is queried, it returns a list of teams that have members in common with the specified channel. For each team in the response, the server includes the `email` attribute associated with that team’s configuration. The application fails to apply proper authorization checks or data sanitization for this field. Consequently, any user with a valid authenticated session, regardless of their role or team membership, can send a request to this endpoint. By enumerating channel IDs, the attacker can systematically harvest the email addresses configured for various teams. This data is intended to be visible only to Team Administrators but is inadvertently exposed to all authenticated users through this API response.
DailyCVE Form
Platform: Mattermost
Version: 10.5.0-10.5.12
Vulnerability: Information Disclosure
Severity: Moderate
Date: 2025-11-27
Prediction: Patched 2025-12-01
What Undercode Say:
curl -H "Authorization: Bearer <TOKEN>" https://mattermost-server/api/v4/channels/<channel_id>/common_teams | jq '.[].email'
// Example structure of vulnerable response
type TeamData struct {
ID string `json:"id"`
Name string `json:"name"`
DisplayName string `json:"display_name"`
Email string `json:"email"` // Leaked field
}
How Exploit:
1. Attacker authenticates to Mattermost.
2. Enumerates or guesses channel IDs.
3. Calls the `/common_teams` endpoint.
4. Parses responses for email addresses.
Protection from this CVE
Upgrade to patched versions: 11.0.3, 10.12.2, 10.11.5, 10.5.13, or applicable 8.x nightly.
Impact:
Sensitive data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
