What is GHSA-x3hx-ch7p-8xgg?

GHSA-x3hx-ch7p-8xgg is a security advisory published by GitHub Security Advisories with Low severity. Mattermost allows regular users to access archived channel content and files

Which CVE IDs does GHSA-x3hx-ch7p-8xgg cover?

GHSA-x3hx-ch7p-8xgg covers the following CVE IDs: CVE-2025-41436. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x3hx-ch7p-8xgg?

GHSA-x3hx-ch7p-8xgg has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-x3hx-ch7p-8xgg?

GHSA-x3hx-ch7p-8xgg affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003c 11.0.0-alpha.1; go/github.com/mattermost/mattermost/server/v8:\u003c 8.0.0-20250815165020-c8d66301415d.

GHSA-x3hx-ch7p-8xggLowCVSS 3.1

Mattermost allows regular users to access archived channel content and files

Vendor

GitHub Security Advisories

Published

November 14, 2025

Last Modified

November 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-41436 →

📋 Description

Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

🎯 Affected products2

go/github.com/mattermost/mattermost-server:< 11.0.0-alpha.1
go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250815165020-c8d66301415d

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-41436
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost/commit/c8d66301415d5b447df0e829bdbaa92e8a83ecf8
https://github.com/advisories/GHSA-x3hx-ch7p-8xgg