~ / search / GHSA-9hh7-6558-qfp2

GHSA-9hh7-6558-qfp2

Mattermost allows other users to determine when users had read channels via channel member objects

Source: GitHub Advisory Database (reviewed) Low CVE-2025-55074

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.4 10.11.4
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.12 10.5.12
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250905150616-ba86dfc5876b6 8.0.0-20250905150616-ba86dfc5876b6

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost versions 10.11.x <= 10.11.3, and 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects.

References

External links from the advisory. They lead to third-party sites.