title: Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents
description: One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents.
problem types: CWE-200 Information Exposure
affected:
{
product: Mattermost
vendor: Mattermost
versions:
lessThan: 6.4.2, status: affected, version: 6.4, versionType: custom
lessThan: 6.3.5, status: affected, version: 6.3, versionType: custom
lessThan: 6.2.5, status: affected, version: 6.2, versionType: custom
lessThan: 5.37.9, status: affected, version: 5.37, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
solutions: Update Mattermost to version v6.4.2, 6.3.5, 6.2.5, or 5.37.9, depending on the minor version being run