GHSA-x3hx-ch7p-8xgg

ghsaUSosv

Mattermost allows regular users to access archived channel content and files

view advisory published 2025-11-14Licence: CC-BY-4.0

Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-41436US	medium4.3OT elevated	0.18% (8th)	—	2025-11-14
Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via t…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://github.com/mattermost/mattermost/commit/c8d66301415d5b447df0e829bdbaa92e8a83ecf8WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-41436ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan