PT-2025-23306 · Mattermost · Mattermost

Bob10X1 · Published 2025-05-30 · Updated 2025-07-03 · CVE-2025-1792

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.7.x through 10.7.0 Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.12

Description The issue is related to the failure of Mattermost to properly enforce access controls for guest users accessing channel member information. This allows authenticated guest users to view metadata about members of public channels via the "channel members API endpoint".

Recommendations For versions 10.7.x through 10.7.0, consider restricting access to the channel members API endpoint to prevent guest users from viewing metadata about members of public channels. For versions 10.5.x through 10.5.3, restrict access to the channel members API endpoint to minimize the risk of exploitation. For versions 9.11.x through 9.11.12, limit the access of guest users to the channel members API endpoint until a fix is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-1792

GHSA-HC6V-386M-93PQ

GO-2025-3730

OPENSUSE-SU-2025:15225-1

Affected Products

Mattermost

References · 41

• https://osv.dev/vulnerability/GHSA-hc6v-386m-93pq · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3730 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1792 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/c23f44fe8ed02f71d506f99adc30ad34c58c89d1 · Note
• https://suse.com/security/cve/CVE-2025-48710 · Note
• https://suse.com/security/cve/CVE-2020-36846 · Note
• https://suse.com/security/cve/CVE-2025-48495 · Note
• https://suse.com/security/cve/CVE-2025-48949 · Note
• https://github.com/advisories/GHSA-hc6v-386m-93pq · Note
• https://suse.com/security/cve/CVE-2025-4128 · Note
• https://suse.com/security/cve/CVE-2025-3230 · Note