GHSA-j6gg-r5jc-47cmMediumCVSS 4.3

Mattermost fails to properly restrict access to archived channel search API

Published
November 14, 2025
Last Modified
November 14, 2025

🔗 CVE IDs covered (1)

CVE-2025-11776 →

📋 Description

Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the /api/v4/teams/{team_id}/channels/search_archived endpoint

🎯 Affected products5

  • go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250815165020-c8d66301415d
  • go/github.com/mattermost/mattermost:< 5.3.2-0.20250815165020-c8d66301415d
  • go/github.com/mattermost/mattermost-server:< 5.3.2-0.20250815165020-c8d66301415d
  • go/github.com/mattermost/mattermost-server/v5:< 5.3.2-0.20250815165020-c8d66301415d
  • go/github.com/mattermost/mattermost-server/v6:< 5.3.2-0.20250815165020-c8d66301415d

🔗 References (4)