Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-27571GO-2025-3619GHSA-H4RR-F37J-4HH7

Channel metadata visible in archived channels despite configuration setting

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 9.11.10+incompatible, 10.4.4+incompatible, 10.5.2+incompatible, 8.0.0-20250218121836-2b5275d87136, 10.5.2, and 3 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Mattermost Mattermost

    From 10.5.0 · through 10.5.1; From 10.4.0 · through 10.4.3; From 9.11.0 · through 9.11.9

  • github.com/mattermost/mattermost-serverGo

    From 9.11.0+incompatible · fixed in 9.11.10+incompatible; From 10.4.0+incompatible · fixed in 10.4.4+incompatible; From 10.5.0+incompatible · fixed in 10.5.2+incompatible

  • github.com/mattermost/mattermost-server/v5Go

    All versions

  • github.com/mattermost/mattermost-server/v6Go

    All versions

  • github.com/mattermost/mattermost/server/v8Go

    fixed in 8.0.0-20250218121836-2b5275d87136

  • github.com/mattermost/mattermost/server/v8Go

    From 10.5.0 · fixed in 10.5.2

  • github.com/mattermost/mattermost/server/v8Go

    From 10.4.0 · fixed in 10.4.4

  • github.com/mattermost/mattermost/server/v8Go

    From 9.11.0 · fixed in 9.11.10

  • github.com/mattermost/mattermost/server/v8Go

    fixed in 8.0.0-20250314142426-c049748b8863

References 1

mattermost.com