CVEvulnerability

CVE-2025-9076

6.5 MEDIUM Published 2025-09-15 Modified 2026-10-19 Official page ↗
Status
Analyzed
Published
2025-09-15
Last modified
2026-10-19
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862

Description

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

Affected configurations

• mattermost mattermost server (>= 10.10.0 < 10.10.2)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References