GHSA-h5v9-xw2g-7hrqMediumCVSS 5.4

Mattermost allows members with permission to convert public channels to private and convert private to public

Published
March 21, 2025
Last Modified
March 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-27933 →

📋 Description

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.

🎯 Affected products5

  • go/github.com/mattermost/mattermost/server/v8:>= 10.4.0, < 10.4.3
  • go/github.com/mattermost/mattermost/server/v8:>= 10.3.0, < 10.3.4
  • go/github.com/mattermost/mattermost/server/v8:>= 9.11.0, < 9.11.9
  • go/github.com/mattermost/mattermost-server:< 9.11.9
  • go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250218135018-e644e3c8e393

🔗 References (3)