GitHub Advisoryadvisory · Go

GHSA-hc6v-386m-93pq Mattermost fails to properly enforce access controls for guest users

LOW Published 2025-05-30 Modified 2025-05-30 Official page ↗
Aliases
CVE-2025-1792
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-05-30

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 10.6.0-rc1, < 10.7.1 → fixed in 10.7.1 • Go github.com/mattermost/mattermost/server/v8: >= 10.0.0-rc1, < 10.5.4 → fixed in 10.5.4 • Go github.com/mattermost/mattermost/server/v8: >= 9.0.0-rc1, < 9.11.13 → fixed in 9.11.13 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250414110750-c23f44fe8ed0 → fixed in 8.0.0-20250414110750-c23f44fe8ed0

Description

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

Related

Alias · CVE (1)

  • CVE-2025-1792 Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References