PT-2026-8340 · Mattermost · Mattermost

Harrison Healey · Published 2026-02-16 · Updated 2026-03-03 · CVE-2025-14350

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.9 Mattermost versions 11.1.x through 11.1.2 Mattermost versions 11.2.x through 11.2.1

Description The software does not properly validate team membership when processing channel mentions. This allows authenticated users to determine the existence of teams and their URL names by posting channel shortlinks and observing the channel mentions property in the API response. The affected API endpoint is not specified.

Recommendations Update Mattermost to a version later than 10.11.9. Update Mattermost to a version later than 11.1.2. Update Mattermost to a version later than 11.2.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14350

GHSA-57CC-2PF4-MHMX

GO-2026-4521

SUSE-SU-2026:0757-1

Affected Products

Mattermost

References · 116

• https://nvd.nist.gov/vuln/detail/CVE-2025-14350 · Security Note
• https://osv.dev/vulnerability/GHSA-57cc-2pf4-mhmx · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14350 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4521 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/761e56bb11ccb751ddbe4bab5898ccc2b384fd82 · Note
• https://suse.com/security/cve/CVE-2025-64111 · Note
• https://suse.com/security/cve/CVE-2026-0998 · Note
• https://suse.com/security/cve/CVE-2026-22892 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://t.me/CVEtracker/44819 · Telegram Post
• https://suse.com/security/cve/CVE-2026-21434 · Note
• https://suse.com/security/cve/CVE-2026-25760 · Note