GitHub Advisoryadvisory · Go

GHSA-mqcj-8c2g-h97q Mattermost Incorrect Authorization vulnerability

LOW Published 2025-11-13 Modified 2025-11-14 Official page ↗
Aliases
CVE-2025-11777
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server, github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost, github.com/mattermost/mattermost-server/v5, github.com/mattermost/mattermost-server/v6
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-11-14

Affected packages

• Go github.com/mattermost/mattermost-server: >= 10.11.0, < 10.11.4 → fixed in 10.11.4 • Go github.com/mattermost/mattermost-server: >= 10.5.0, < 10.5.12 → fixed in 10.5.12 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250905150616-ba86dfc5876b → fixed in 8.0.0-20250905150616-ba86dfc5876b • Go github.com/mattermost/mattermost: < 5.3.2-0.20250905150616-ba86dfc5876b → fixed in 5.3.2-0.20250905150616-ba86dfc5876b • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20250905150616-ba86dfc5876b → fixed in 5.3.2-0.20250905150616-ba86dfc5876b • Go github.com/mattermost/mattermost-server/v5: < 5.3.2-0.20250905150616-ba86dfc5876b → fixed in 5.3.2-0.20250905150616-ba86dfc5876b • Go github.com/mattermost/mattermost-server/v6: < 5.3.2-0.20250905150616-ba86dfc5876b → fixed in 5.3.2-0.20250905150616-ba86dfc5876b

Description

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.

Related

Alias · CVE (1)

  • CVE-2025-11777 Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References