Mattermost versions prior to 11.9.2, 11.8.6, 11.7.11, and 11.10.2 fail to sanitize the "active channel" field returned by the user status API endpoints. As a result, an authenticated user can discover the channel ID of a private channel that another user is actively viewing, even when the requester is not a member of that channel. The disclosure of a private channel identifier does not grant membership or direct access.

The vulnerability affects Mattermost installations running any of the following affected releases: 11.9.x up to and including 11.9.1, 11.8.x up to and including 11.8.5, 11.7.x up to and including 11.7.10, and 11.10.x up to and including 11.10.1. The vendor has provided a fix in all newer releases beginning with 11.9.2, 11.8.6, 11.7.11, 11.10.2, and 11.11.0 or later. Updating to these versions removes the sanitization flaw.

The CVSS score of this issue is 4.3, indicating a moderate severity. The EPSS score is <1%, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA's KEV database. The attack requires the attacker to be an authenticated user and to have a legitimate session. The vulnerability does not allow direct intrusion or data compromise beyond identifying a private channel ID. Therefore, the risk is moderate, and organizations should patch promptly.