title: Files of archived channels accessible with the “Allow users to view archived channels” option disabled
description: Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.
problem types: CWE-284: Improper Access Control
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 8.1.8, status: affected, version: 0, versionType: semver
lessThanOrEqual: 9.4.1, status: affected, version: 0, versionType: semver
status: unaffected, version: 9.5.0
status: unaffected, version: 9.4.2
status: unaffected, version: 8.1.9
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.5.0, 9.4.2, 8.1.9 or higher.