CVE-2025-9076
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
- CVSS 3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3vcm-c42p-3hhf | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250729073403-517ae758cd02 | 8.0.0-20250729073403-517ae758cd02 |
| GHSA-3vcm-c42p-3hhf | Go | github.com/mattermost/mattermost-server | >=10.10.0 <10.10.2 | 10.10.2 |
| GO-2025-3950 | Go | github.com/mattermost/mattermost-server | >=10.10.0+incompatible <10.10.2+incompatible | 10.10.2+incompatible |
| GO-2025-3950 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2025-3950 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2025-3950 | Go | github.com/mattermost/mattermost/server/v8 | all versions | no fix published |