What’s Vulnerable › Vulnerabilities
CVE-2022-0708: Team Creator's Email Address is disclosed to Team Members via one of the APIs
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-02-21 · updated 2026-06-17
- Weakness: CWE-200
Description
Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
Affected products
- Mattermost App Framework: through 6.3.0
References
Get alerted when CVE-2022-0708 or the next vulnerability affects your stack