Group member IDs leaked because GetGroup bypassed view restrictions (CVE-2026-3115)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/api4/group.go:119

   getGroup

2. 1
   Step 01server/channels/api4/group.go:119-128

   The API handler derives ViewUsersRestrictions for the current session and calls GetGroup with IncludeMemberIDs controlled by the query string.

   restrictions, appErr := c.App.GetViewUsersRestrictions(c.AppContext, c.AppContext.Session().UserId)
   if appErr != nil {
       c.Err = appErr
       return
   }
   
   group, appErr := c.App.GetGroup(c.Params.GroupId, &model.GetGroupOpts{
       IncludeMemberCount: c.Params.IncludeMemberCount,
       IncludeMemberIDs:   c.Params.IncludeMemberIDs,
   }, restrictions)
   

3. 2
   Step 02server/channels/app/group.go:28-39

   Before the patch, IncludeMemberIDs called GetMemberUsers(id) and appended every returned user ID. The patched code pages through GetMemberUsersPage with the same view restrictions.

   if opts != nil && opts.IncludeMemberIDs {
       perPage := 100
       users, err := utils.Pager(func(page int) ([]*model.User, error) {
           return a.Srv().Store().Group().GetMemberUsersPage(id, page, perPage, viewRestrictions)
       }, perPage)
       if err != nil {
           return nil, model.NewAppError("GetGroup", "app.member_count", nil, "", http.StatusInternalServerError).Wrap(err)
       }
   
       for _, user := range users {
           group.MemberIDs = append(group.MemberIDs, user.Id)
       }
   }
   

4. 3
   Step 03server/channels/store/sqlstore/group_store.go:494-508

   GetMemberUsers is the unrestricted store method that previously fed the response. It filters only deleted rows and group ID, not caller visibility.

   builder := s.groupMemberUsersSelectQuery.
       Where(sq.Eq{
           "GroupMembers.DeleteAt": 0,
           "Users.DeleteAt":        0,
           "GroupMembers.GroupId":  groupID,
       })
   
   if err := s.GetReplica().SelectBuilder(&groupMembers, builder); err != nil {
       return nil, errors.Wrapf(err, "failed to find member Users for Group with id=%s", groupID)
   }
   

5. 4
   Step 04server/channels/store/sqlstore/group_store.go:515-523

   The patched path uses GetMemberUsersPage / GetMemberUsersSortedPage, where applyViewRestrictionsFilter limits results to users visible through the caller's teams or channels.

   userQuery := s.groupMemberUsersSelectQuery.
       Where(sq.Eq{"GroupMembers.DeleteAt": 0}).
       Where(sq.Eq{"Users.DeleteAt": 0}).
       Where(sq.Eq{"GroupMembers.GroupId": groupID})
   
   userQuery = applyViewRestrictionsFilter(userQuery, viewRestrictions, true)
   

6. Sinkserver/channels/app/group.go:28

   App.GetGroup