VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 3, 2024· Updated Aug 2, 2024

Channel IDs of archived/restored channels leaked via webhook events

CVE-2024-39807

Description

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring webhook events to retrieve the channel IDs of archived or restored channels.

Affected products

1

Patches

2
01723a784c5e
https://github.com/mattermost/mattermost-servervia osv
6eb3d42f52be
https://github.com/mattermost/mattermost-servervia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.