{"id":"CVE-2024-23488","aliases":["EUVD-2024-0766","GHSA-xgxj-j98c-59rv","GO-2024-2595"],"status":"published","title":"Files of archived channels accessible with the “Allow users to view archived channels” option disabled","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00314,"percentile":0.24615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2024-02-29T08:03:20Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","fixed_in":["9.4.2","8.1.9"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","fixed_in":["9.4.2+incompatible"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.4.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.4.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0+incompatible"},{"fixed":"9.4.2+incompatible"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"mattermost","product":"mattermost"},{"vendor":"mattermost","product":"mattermost_server"}],"references":[{"url":"https://mattermost.com/security-updates","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23488","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xgxj-j98c-59rv","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23488.json","tags":["advisory"]},{"url":"https://github.com/mattermost/mattermost","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-23488","title":"Files of archived channels accessible with the “Allow users to view archived channels” option disabled","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n","status":"published","published":"2024-02-29T08:03:20.744Z","modified":"2024-08-01T23:06:24.721Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0766","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n","status":"published","published":"2024-02-29T08:03:20Z","modified":"2024-08-01T23:06:24Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T03:50:29.401303Z"}],"ghsa":[{"id":"GHSA-xgxj-j98c-59rv","title":"Mattermost fails to properly restrict the access of files attached to posts","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n","status":"published","published":"2024-02-29T09:30:34Z","modified":"2026-03-19T05:03:18Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"nvd":[{"id":"CVE-2024-23488","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n","status":"published","published":"2024-02-29T08:15:47.11Z","modified":"2026-06-17T07:13:02.97Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-23488","title":"Files of archived channels accessible with the “Allow users to view archived channels” option disabled","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n","status":"published","published":"2024-02-29T08:03:20.744Z","modified":"2026-10-28T02:30:45.588681631Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"GHSA-xgxj-j98c-59rv","title":"Mattermost fails to properly restrict the access of files attached to posts","description":"Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the “Allow users to view archived channels” option is disabled.\n\n","status":"published","published":"2024-02-29T09:30:34Z","modified":"2026-09-10T03:50:00.23226535Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"GO-2024-2595","title":"Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server","description":"Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/mattermost/mattermost/server/v8 before v8.1.9.","status":"published","published":"2024-06-28T15:28:53Z","modified":"2026-02-04T02:39:28.712318Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}