An authenticated attacker who can create, patch, import, or bulk‑create boards in Mattermost can exploit a permission check failure to link a board to a private channel without first verifying the user has read access to that channel. This allows the attacker to learn the membership list of any private channel on the same team, revealing who is participating in private discussions. The underlying weakness corresponds to CWE‑862: Permission Check Failure, resulting in an unauthorized disclosure of confidential channel membership information.

Affected by the advisory are Mattermost distributions with versions 11.7.x up to 11.7.6, 10.11.x up to 10.11.21, and 11.8.x up to 11.8.3. These releases lack the proper validation to ensure that a user has read privilege before a board is linked to a channel, leaving all teams using these versions exposed.

The CVSS base score of 4.3 indicates a moderate overall risk. Exploitation is only possible for authenticated users, so the attack vector is internal, requiring an account with the ability to create or modify boards. Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is currently uncertain, but organizations should treat it as a moderate risk pending patching, as it could expose sensitive team membership details.