GHSA-3vcm-c42p-3hhf

ghsaUSosv

Mattermost Missing Authorization vulnerability

view advisory published 2025-09-15Licence: CC-BY-4.0

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-9076US	medium6.5OT elevated	0.26% (18th)	—	2025-09-15
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters t…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-9076ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan