CVE-2023-48732

Keywords that trigger mentions are leaked to other users

4.3 MediumFix available

Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.46%Up 0.4 points since Jan 3, 2024

What each source reports

CVE List Score used 4.3

Keywords that trigger mentions are leaked to other users

Record: CVE-2023-48732
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2024-0399 4.3

Record: EUVD-2024-0399
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q7rx-w656-fwmv 5.3

Mattermost notified all users in the channel when using WebSockets to respond individually

Record: GHSA-q7rx-w656-fwmv
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 4.3

Record: CVE-2023-48732
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 4.3

Keywords that trigger mentions are leaked to other users

Record: CVE-2023-48732
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-q7rx-w656-fwmv 5.3

Mattermost notified all users in the channel when using WebSockets to respond individually

Record: GHSA-q7rx-w656-fwmv
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVBIT-mattermost-2023-48732 No score

Record: BIT-mattermost-2023-48732
Updated: 2026-11-02

OSVGO-2024-2448 No score

Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server

Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.7.

Record: GO-2024-2448
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/mattermost/mattermost/server/v8` Go	through 8.1.6	8.1.7
`github.com/mattermost/mattermost-server/v6` Go	through 8.1.6	8.1.7
`mattermost` Bitnami	before 8.1.7	8.1.7
`github.com/mattermost/mattermost/server/v8` Go	before 8.1.7	8.1.7
`github.com/mattermost/mattermost-server/v6` Go	before 8.1.7	8.1.7
`github.com/mattermost/mattermost-server` Go	before 8.1.7+incompatible	8.1.7+incompatible
`github.com/mattermost/mattermost-server/v5` Go	All versions	None known
`github.com/mattermost/mattermost-server/v6` Go	All versions	None known
`github.com/mattermost/mattermost/server/v8` Go	All versions	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-48732 is a medium vulnerability (CVSS 4.3) in Mattermost, published January 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in github.com/mattermost/mattermost/server/v8 8.1.7.