GitHub Advisoryadvisory · Go

GHSA-x3hx-ch7p-8xgg Mattermost allows regular users to access archived channel content and files

LOW Published 2025-11-14 Modified 2025-11-17 Official page ↗
Aliases
CVE-2025-41436
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server, github.com/mattermost/mattermost/server/v8
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-11-17

Affected packages

• Go github.com/mattermost/mattermost-server: < 11.0.0-alpha.1 → fixed in 11.0.0-alpha.1 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250815165020-c8d66301415d → fixed in 8.0.0-20250815165020-c8d66301415d

Description

Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

Related

Alias · CVE (1)

  • CVE-2025-41436 Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References