CVE-2023-5160

    Dashboard / Vulnerabilities / CVE-2023-5160

    CVE-2023-5160

    Published: 2 Oct 2023Last Modified: 25 Sept 2026

    Summary: Full name disclosure via team top membership with Show Full Name option disabled

    Details: Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled

    References: https://mattermost.com/security-updates, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5160.json, https://nvd.nist.gov/vuln/detail/CVE-2023-5160

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 70da7adaff636f074316d05e0b4408f0721eee7b
    Fixed -ccceee77061add55f4ff849d5505fdb3e46b30e2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-5160 | CVE-DB