What is GHSA-3vcm-c42p-3hhf?

GHSA-3vcm-c42p-3hhf is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost Missing Authorization vulnerability

Which CVE IDs does GHSA-3vcm-c42p-3hhf cover?

GHSA-3vcm-c42p-3hhf covers the following CVE IDs: CVE-2025-9076. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3vcm-c42p-3hhf?

GHSA-3vcm-c42p-3hhf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-3vcm-c42p-3hhf?

GHSA-3vcm-c42p-3hhf affects 2 products, including: go/github.com/mattermost/mattermost/server/v8:\u003c 8.0.0-20250729073403-517ae758cd02; go/github.com/mattermost/mattermost-server:\u003e= 10.10.0, \u003c 10.10.2.

GHSA-3vcm-c42p-3hhfMediumCVSS 6.5

Mattermost Missing Authorization vulnerability

Vendor

GitHub Security Advisories

Published

September 15, 2025

Last Modified

September 15, 2025

🔗 CVE IDs covered (1)

CVE-2025-9076 →

📋 Description

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

🎯 Affected products2

go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250729073403-517ae758cd02
go/github.com/mattermost/mattermost-server:>= 10.10.0, < 10.10.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-9076
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-3vcm-c42p-3hhf