GHSA-rp74-x43m-cpw3

ghsaUSosv

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

view advisory published 2025-03-21Licence: CC-BY-4.0

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-24920US	medium4.3OT elevated	0.24% (15th)	—	2025-03-21
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authent…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-24920ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan