What’s Vulnerable › Vulnerabilities
CVE-2024-23488: Files of archived channels accessible with the “Allow users to view archived channels” option disabled
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-02-29 · updated 2026-06-17
- Weakness: CWE-284
Description
Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
Affected products
- Mattermost: before 8.1.9; from 9.0.0 before 9.4.2 — fixed in 8.1.9, 9.4.2
How to fix
Upgrade to a fixed version: Mattermost 8.1.9, 9.4.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-23488 or the next vulnerability affects your stack