PT-2025-16566 · Mattermost · Mattermost

Hackit_Bharat · Published 2025-04-16 · Updated 2025-04-23 · CVE-2025-27571

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.9 Mattermost versions 10.4.x through 10.4.3 Mattermost versions 10.5.x through 10.5.1

Description The issue arises from the failure to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels. This allows authenticated users to access such information when a channel is archived.

Recommendations For versions 9.11.x through 9.11.9, update the configuration to properly enforce the "Allow Users to View Archived Channels" setting. For versions 10.4.x through 10.4.3, ensure that the channel metadata access is restricted based on the "Allow Users to View Archived Channels" configuration. For versions 10.5.x through 10.5.1, modify the channel metadata fetching process to account for the "Allow Users to View Archived Channels" setting, preventing unauthorized access to archived channel information.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-27571

GHSA-H4RR-F37J-4HH7

GO-2025-3619

OPENSUSE-SU-2025:15017-1

Affected Products

Mattermost

References · 43

• https://osv.dev/vulnerability/GO-2025-3619 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27571 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27571 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h4rr-f37j-4hh7 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/341186355d982ac4cbe37668d7cdb0cf6275fe44 · Note
• https://github.com/mattermost/mattermost/commit/629f68a85dd6ed5ba0c51a9356c3a3200f50657f · Note
• https://github.com/mattermost/mattermost/commit/c6f6b664811795f36b9cf05b0e2b537c44c65bc1 · Note
• https://github.com/mattermost/mattermost/commit/8e82d8df61068fc56b0f3e51ef1cc947bc87cec1 · Note
• https://github.com/mattermost/mattermost/commit/ae8a952bcaaa5f77a92043e2538f625eac72e927 · Note
• https://suse.com/security/cve/CVE-2025-3801 · Note
• https://suse.com/security/cve/CVE-2025-1386 · Note
• https://suse.com/security/cve/CVE-2025-30206 · Note