~ / search / GHSA-424h-xj87-m937

GHSA-424h-xj87-m937

Mattermost has an Incorrect Authorization vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2025-10545

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250820115038-ff30b84049f0 8.0.0-20250820115038-ff30b84049f0
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.11 10.5.11
Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.3 10.11.3

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint

References

External links from the advisory. They lead to third-party sites.