Описание
Mattermost Incorrect Authorization vulnerability
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2025-11777
- https://github.com/mattermost/mattermost/commit/98acefe911dd9de7edf47a7d825dd99f53141a52
- https://github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149
- https://github.com/mattermost/mattermost/commit/d72d437f1567ba0b639b6e4fd73bab06c51baab5
- https://mattermost.com/security-updates
Пакеты
github.com/mattermost/mattermost-server
>= 10.11.0, < 10.11.4
10.11.4
github.com/mattermost/mattermost-server
>= 10.5.0, < 10.5.12
10.5.12
github.com/mattermost/mattermost/server/v8
< 8.0.0-20250905150616-ba86dfc5876b
8.0.0-20250905150616-ba86dfc5876b
github.com/mattermost/mattermost
< 5.3.2-0.20250905150616-ba86dfc5876b
5.3.2-0.20250905150616-ba86dfc5876b
github.com/mattermost/mattermost-server
< 5.3.2-0.20250905150616-ba86dfc5876b
5.3.2-0.20250905150616-ba86dfc5876b
github.com/mattermost/mattermost-server/v5
< 5.3.2-0.20250905150616-ba86dfc5876b
5.3.2-0.20250905150616-ba86dfc5876b
github.com/mattermost/mattermost-server/v6
< 5.3.2-0.20250905150616-ba86dfc5876b
5.3.2-0.20250905150616-ba86dfc5876b
Связанные уязвимости
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to prop ...