Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
References
| Link | Resource |
|---|---|
| https://mattermost.com/security-updates | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
29 Oct 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint |
21 Oct 2025, 13:07
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mattermost mattermost Server
Mattermost |
|
| CPE | cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* | |
| References | () https://mattermost.com/security-updates - Vendor Advisory |
16 Oct 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-16 08:15
Updated : 2025-10-29 08:15
NVD link : CVE-2025-41443
Mitre link : CVE-2025-41443
CVE.ORG link : CVE-2025-41443
JSON object : View
Products Affected
mattermost
- mattermost_server
CWE
CWE-862
Missing Authorization