CVSS 3.1
3.1 lowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2025-1792
Low (3.1) in mattermost mattermost server. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 10.5.4, 10.7.1, 8.0.0-20250414110750-c23f44fe8ed0.
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hc6v-386m-93pq | Go | github.com/mattermost/mattermost/server/v8 | >=10.6.0-rc1 <10.7.1 | 10.7.1 |
| GHSA-hc6v-386m-93pq | Go | github.com/mattermost/mattermost/server/v8 | >=10.0.0-rc1 <10.5.4 | 10.5.4 |
| GHSA-hc6v-386m-93pq | Go | github.com/mattermost/mattermost/server/v8 | >=9.0.0-rc1 <9.11.13 | 9.11.13 |
| GHSA-hc6v-386m-93pq | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250414110750-c23f44fe8ed0 | 8.0.0-20250414110750-c23f44fe8ed0 |
| GO-2025-3730 | Go | github.com/mattermost/mattermost-server | >=9.0.0-rc1+incompatible <9.11.13+incompatible >=10.0.0-rc1+incompatible <10.5.4+incompatible >=10.6.0-rc1+incompatible <10.7.1+incompatible | 9.11.13+incompatible, 10.5.4+incompatible, 10.7.1+incompatible |
| GO-2025-3730 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2025-3730 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2025-3730 | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250414110750-c23f44fe8ed0 | 8.0.0-20250414110750-c23f44fe8ed0 |