CVE-2025-11777
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint
- CVSS 3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-25)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost-server | >=10.11.0 <10.11.4 | 10.11.4 |
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost-server | >=10.5.0 <10.5.12 | 10.5.12 |
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250905150616-ba86dfc5876b | 8.0.0-20250905150616-ba86dfc5876b |
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost | <5.3.2-0.20250905150616-ba86dfc5876b | 5.3.2-0.20250905150616-ba86dfc5876b |
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost-server | <5.3.2-0.20250905150616-ba86dfc5876b | 5.3.2-0.20250905150616-ba86dfc5876b |
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost-server/v5 | <5.3.2-0.20250905150616-ba86dfc5876b | 5.3.2-0.20250905150616-ba86dfc5876b |
| GHSA-mqcj-8c2g-h97q | Go | github.com/mattermost/mattermost-server/v6 | <5.3.2-0.20250905150616-ba86dfc5876b | 5.3.2-0.20250905150616-ba86dfc5876b |
| GO-2025-4122 | Go | github.com/mattermost/mattermost | all versions | no fix published |
| GO-2025-4122 | Go | github.com/mattermost/mattermost/v5 | all versions | no fix published |
| GO-2025-4122 | Go | github.com/mattermost/mattermost-server | >=10.5.0+incompatible <10.5.12+incompatible >=10.11.0+incompatible <10.11.4+incompatible | 10.5.12+incompatible, 10.11.4+incompatible |
| GO-2025-4122 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2025-4122 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2025-4122 | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20251212204551-54f2e9b4afd5 | 8.0.0-20251212204551-54f2e9b4afd5 |