CVE-2023-6202

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62037.5The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted CVE-2023-62046.5On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the CVE-2023-62056.5It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.CVE-2023-62065.4The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible CVE-2023-62078.8Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and CVE-2023-62088.8When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not CVE-2023-62096.5Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override th CVE-2023-62106.5When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as ifr CVE-2023-62116.5If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked CVE-2023-62128.8Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption CVE-2023-62138.8Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-62147.5The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and