CVE-2022-2401
Team members could access sensitive information of other users via an API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Team members could access sensitive information of other users via an API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
CVE-2022-2401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-6283
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
EUVD-2022-6283- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7ggc-5r84-xf54
Mattermost users could access some sensitive information via API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
GHSA-7ggc-5r84-xf54- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
CVE-2022-2401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Team members could access sensitive information of other users via an API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
CVE-2022-2401- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-7ggc-5r84-xf54
Mattermost users could access some sensitive information via API call
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
GHSA-7ggc-5r84-xf54- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVBIT-mattermost-2022-2401 No score
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
- Record
BIT-mattermost-2022-2401- Updated
- 2026-11-02
OSVGO-2022-0540 No score
Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server
Mattermost users could access some sensitive information via API call in github.com/mattermost/mattermost-server
- Record
GO-2022-0540- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost-server/v6Go |
before 6.3.9 | 6.3.9 |
github.com/mattermost/mattermost-server/v6Go |
6.4.0 up to 6.5.2 | 6.5.2 |
github.com/mattermost/mattermost-server/v6Go |
6.6.0 up to 6.6.2 | 6.6.2 |
github.com/mattermost/mattermost-server/v6Go |
6.7.0 to 6.7.0 | 6.7.1 |
mattermostBitnami |
before 6.3.9, 6.4.0 up to 6.5.2, 6.6.0 to 6.6.0, 6.6.1 to 6.6.1, 6.7.0 to 6.7.0 | 6.3.96.5.2 |
github.com/mattermost/mattermost-server/v6Go |
6.7.0 up to 6.7.1 | 6.7.1 |
github.com/mattermost/mattermost-serverGo |
All versions | None known |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
before 6.3.9, 6.4.0 up to 6.5.2, 6.6.0 up to 6.6.2, 6.7.0 up to 6.7.1 | 6.3.96.5.26.6.26.7.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2401 is a medium vulnerability (CVSS 6.5) in Mattermost, published July 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in github.com/mattermost/mattermost-server/v6 6.3.9.