GitHub Advisoryadvisory · Go

GHSA-3vcm-c42p-3hhf Mattermost Missing Authorization vulnerability

MEDIUM Published 2025-09-15 Modified 2025-09-15 Official page ↗
Aliases
CVE-2025-9076
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-862
Reviewed
2025-09-15

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250729073403-517ae758cd02 → fixed in 8.0.0-20250729073403-517ae758cd02 • Go github.com/mattermost/mattermost-server: >= 10.10.0, < 10.10.2 → fixed in 10.10.2

Description

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

Related

Alias · CVE (1)

  • CVE-2025-9076 Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References