PT-2025-42437 · Mattermost · Mattermost

Lordwillmore · Published 2025-10-16 · Updated 2025-11-07 · CVE-2025-41443

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.11.x through 10.11.2

Description The software does not properly validate guest user permissions when accessing channel information. This allows guest users to discover active public channels and their metadata. The affected API endpoint is /api/v4/teams/{team id}/channels/ids. The team id is a vulnerable parameter.

Recommendations Update Mattermost to a version later than 10.5.10. Update Mattermost to a version later than 10.11.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-41443

GHSA-7CR3-38JM-6P45

GO-2025-4031

OPENSUSE-SU-2025:15710-1

Affected Products

Mattermost

References · 83

• https://osv.dev/vulnerability/GO-2025-4031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41443 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cr3-38jm-6p45 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41443 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/e8c7e7d0252bbf1e098aae4a5ea05d945afd7e70 · Note
• https://github.com/mattermost/mattermost/pull/33778 · Note
• https://github.com/mattermost/mattermost/pull/31327 · Note
• https://suse.com/security/cve/CVE-2025-58356 · Note
• https://suse.com/security/cve/CVE-2025-61141 · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note
• https://suse.com/security/cve/CVE-2025-62375 · Note
• https://suse.com/security/cve/CVE-2016-11074 · Note