~ / search / GHSA-7h34-9chr-58qh

GHSA-7h34-9chr-58qh

Mattermost Missing Authentication for Critical Function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-6226

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.7 10.5.7
Go github.com/mattermost/mattermost-server >= 10.8.0, < 10.8.2 10.8.2
Go github.com/mattermost/mattermost-server >= 10.7.0, < 10.7.4 10.7.4
Go github.com/mattermost/mattermost-server >= 9.11.0, < 9.11.17 9.11.17
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250520130510-fa40a8c5d47f 8.0.0-20250520130510-fa40a8c5d47f

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.

References

External links from the advisory. They lead to third-party sites.