CVE-2023-2787: Collapsed Reply Threads APIs leak message contents from private channels
6.5
CVSS
Description
Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message threads API.
Classification
CVE ID: CVE-2023-2787
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
Affected Products
Vendor: Mattermost
Product: Mattermost
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.06% (probability of being exploited)
EPSS Percentile: 28.68% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)