CVE-2024-1887: 
Chainguard vulnerability analysis and mitigation

Mattermost fails to check if compliance export is enabled when fetching posts of public channels, allowing a user that is not a member of the public channel to fetch posts without being audited in the compliance export. This vulnerability was discovered and disclosed on February 29, 2024, affecting Mattermost platforms (NVD).

The vulnerability has been assigned CVE-2024-1887 and is classified as an Improper Access Control (CWE-284) issue. It has been given a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating that it requires network access and low privileges to exploit, but has limited impact (NVD).

The vulnerability allows unauthorized users to access posts in public channels without proper audit trails in the compliance export system. This could potentially lead to unmonitored access to sensitive information and bypass of compliance monitoring mechanisms (NVD).

The vulnerability can be exploited by an authenticated user with basic access to the Mattermost platform. The attacker needs to be authenticated but does not need to be a member of the target public channel to exploit this vulnerability (NVD).

Users are advised to update to the latest version of Mattermost that contains the fix for this vulnerability. The issue has been addressed in subsequent security updates (Mattermost Security).