title: Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
description: Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.
problem types: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
defaultStatus: unaffected
product: Mattermost
vendor: Mattermost
versions:
lessThanOrEqual: 7.8.12, status: affected, version: 0, versionType: semver
lessThanOrEqual: 8.1.3, status: affected, version: 0, versionType: semver
lessThanOrEqual: 9.0.1, status: affected, version: 0, versionType: semver
lessThanOrEqual: 9.1.0, status: affected, version: 0, versionType: semver
status: unaffected, version: 9.0.2
status: unaffected, version: 9.1.1
status: unaffected, version: 7.8.13
status: unaffected, version: 8.1.4
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Mattermost Server to versions 9.0.2, 9.1.1, 7.8.13, 8.1.4 or higher.