What’s Vulnerable › Vulnerabilities

CVE-2023-43754: Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-27 · updated 2026-06-17
• Weakness: CWE-200

Description

Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.

Affected products

• Mattermost App Framework: through 7.8.12; from 8.0.0 through 8.1.3; from 9.0.0 through 9.0.1; 9.1.0

References

• https://mattermost.com/security-updates
• https://mattermost.com/security-updates

Get alerted when CVE-2023-43754 or the next vulnerability affects your stack