Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mattermost_server | Mattermost | * | 8.1.7 (excluding) |
| Mattermost_server | Mattermost | 9.0.0 (including) | 9.0.5 (excluding) |
| Mattermost_server | Mattermost | 9.1.0 (including) | 9.1.4 (excluding) |
| Mattermost_server | Mattermost | 9.2.0 (including) | 9.2.3 (excluding) |