What is GHSA-c253-8hr4-r8v9?

GHSA-c253-8hr4-r8v9 is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Server exposes private team invite ID

Which CVE IDs does GHSA-c253-8hr4-r8v9 cover?

GHSA-c253-8hr4-r8v9 covers the following CVE IDs: CVE-2017-18901. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c253-8hr4-r8v9?

GHSA-c253-8hr4-r8v9 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-c253-8hr4-r8v9?

GHSA-c253-8hr4-r8v9 affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003c 3.10.3; go/github.com/mattermost/mattermost-server:\u003e= 4.0.0, \u003c 4.0.4.

GHSA-c253-8hr4-r8v9MediumCVSS 5.3

Mattermost Server exposes private team invite ID

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 12, 2026

🔗 CVE IDs covered (1)

CVE-2017-18901 →

📋 Description

An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.

🎯 Affected products2

go/github.com/mattermost/mattermost-server:< 3.10.3
go/github.com/mattermost/mattermost-server:>= 4.0.0, < 4.0.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2017-18901
https://github.com/mattermost/mattermost/commit/5e822a7d09214d5446d54e02a0611df8e64f3aa5
https://github.com/mattermost/mattermost/commit/638c38cc0d2296335a0fbd5bde8b6d2cbf9f9062
https://github.com/mattermost/mattermost/commit/a78ed923f1c73ae5551893374fb9803ee2f4c8e6
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-c253-8hr4-r8v9