CVE-2023-5331 MEDIUM

CVE-2023-5331: File Information Leak via IDOR in file_id in Draft Posts

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published October 9, 2023
Last update September 5, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.

Key dates

02Disclosure timeline

October 9, 2023 CVE published
September 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-36246 CVE-2023-40331 WordPress Accordion Slider plugin <= 1.9.6 - Broken Access Control vulnerability CVE-2025-58978 WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control Vulnerability CVE-2026-22172 OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections CVE-2025-62154 WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin <= 1.1.7 - Broken Access Control vulnerability