CVE-2024-1887
Public channel post content accessible without membership when compliance export is enabled
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Public channel post content accessible without membership when compliance export is enabled
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
- Record
CVE-2024-1887- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-0634
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
- Record
EUVD-2024-0634- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fx48-xv6q-6gp3
Mattermost post fetching without auditing in compliance export
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
- Record
GHSA-fx48-xv6q-6gp3- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
- Record
CVE-2024-1887- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Public channel post content accessible without membership when compliance export is enabled
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
- Record
CVE-2024-1887- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-07
OSVGHSA-fx48-xv6q-6gp3
Mattermost post fetching without auditing in compliance export
Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.
- Record
GHSA-fx48-xv6q-6gp3- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGO-2024-2591No score
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.
- Record
GO-2024-2591- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go | 9.3.0 up to 9.3.1 | 9.3.1 |
github.com/mattermost/mattermost/server/v8Go | 9.2.0 up to 9.2.5 | 9.2.5 |
github.com/mattermost/mattermost/server/v8Go | before 8.1.9 | 8.1.9 |
github.com/mattermost/mattermost-serverGo | 9.2.0+incompatible up to 9.2.5+incompatible, 9.3.0+incompatible up to 9.3.1+incompatible | 9.2.5+incompatible9.3.1+incompatible |
github.com/mattermost/mattermost-server/v5Go | All versions | None known |
github.com/mattermost/mattermost-server/v6Go | All versions | None known |
github.com/mattermost/mattermost/server/v8Go | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1887 is a medium vulnerability (CVSS 4.3) in Mattermost, published February 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in github.com/mattermost/mattermost/server/v8 9.3.1.