PT-2025-12411 · Mattermost · Mattermost

Mrhashimamin · Published 2025-03-21 · Updated 2025-03-28 · CVE-2025-27933

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.8 Mattermost versions 10.3.x through 10.3.3 Mattermost versions 10.4.x through 10.4.2

Description The issue arises from the failure to enforce channel conversion restrictions. This allows members with permission to convert public channels to private ones to also convert private channels to public, potentially exposing sensitive information.

Recommendations For versions 9.11.x through 9.11.8, update to a version that enforces channel conversion restrictions. For versions 10.3.x through 10.3.3, update to a version that enforces channel conversion restrictions. For versions 10.4.x through 10.4.2, update to a version that enforces channel conversion restrictions.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-MATTERMOST-2025-27933

CVE-2025-27933

GHSA-H5V9-XW2G-7HRQ

GO-2025-3556

OPENSUSE-SU-2025:14937-1

Affected Products

Mattermost

References · 44

• https://osv.dev/vulnerability/GO-2025-3556 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27933 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5v9-xw2g-7hrq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2025-27933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27933 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/advisories/GHSA-h5v9-xw2g-7hrq · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB · Note
• https://suse.com/security/cve/CVE-2024-9900 · Note
• https://suse.com/security/cve/CVE-2024-25132 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27933 · Note
• https://suse.com/security/cve/CVE-2025-30204 · Note
• https://suse.com/security/cve/CVE-2024-53348 · Note