title: Team Creator's Email Address is disclosed to Team Members via one of the APIs
description: Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
problem types: CWE-200 Information Exposure
affected:
{
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 6.3.0, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: unaffected, version: 6.2.2, versionType: custom
lessThan: unspecified, status: unaffected, version: 6.1.2, versionType: custom
lessThan: unspecified, status: unaffected, version: 5.37.7, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]