CVE-2021-37864

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-378655.7Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which al CVE-2021-378667.5Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows CVE-2021-378674.3Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenti CVE-2021-37877.8A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the M CVE-2021-37886.8An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access u CVE-2021-37894.6An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with phys CVE-2021-37906.5A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated CVE-2021-379099.8WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry witho CVE-2021-37916.5An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated at CVE-2021-379105.3ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthentic CVE-2021-379118.8The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any sy CVE-2021-379129.8The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting p