Vulnerability-Lookup

CVE-2025-27571 (GCVE-0-2025-27571)

Vulnerability from cvelistv5 – Published: 2025-04-16 07:45 – Updated: 2025-04-16 14:34

Title

Channel metadata visible in archived channels despite configuration setting

Summary

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-16 14:19 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

Mattermost mitre root

References

1 reference

URL	Tags
https://mattermost.com/security-updates

Impacted products

1 product

Vendor	Product	Version	CPE status
Mattermost	Mattermost	Affected: 10.5.0 , ≤ 10.5.1 (semver) Affected: 10.4.0 , ≤ 10.4.3 (semver) Affected: 9.11.0 , ≤ 9.11.9 (semver) Unaffected: 10.6.0 Unaffected: 10.5.2 Unaffected: 10.4.4 Unaffected: 9.11.10	guessed

Credits

hackit_bharat

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27571",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T14:19:48.223409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T14:34:19.313Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.5.1",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.4.3",
              "status": "affected",
              "version": "10.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.9",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.6.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.2"
            },
            {
              "status": "unaffected",
              "version": "10.4.4"
            },
            {
              "status": "unaffected",
              "version": "9.11.10"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hackit_bharat"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMattermost versions 10.5.x \u0026lt;= 10.5.1, 10.4.x \u0026lt;= 10.4.3, 9.11.x \u0026lt;= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Mattermost versions 10.5.x \u003c= 10.5.1, 10.4.x \u003c= 10.4.3, 9.11.x \u003c= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-16T07:45:58.802Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher.\u003c/p\u003e"
            }
          ],
          "value": "Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2025-00452",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-63192"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Channel metadata visible in archived channels despite configuration setting",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2025-27571",
    "datePublished": "2025-04-16T07:45:58.802Z",
    "dateReserved": "2025-04-08T07:50:19.660Z",
    "dateUpdated": "2025-04-16T14:34:19.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-27571",
      "date": "2026-09-26",
      "epss": "0.00268",
      "percentile": "0.16984"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Mattermost",
                "vendor": "Mattermost",
                "versions": [
                  {
                    "lessThanOrEqual": "10.5.1",
                    "status": "affected",
                    "version": "10.5.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "10.4.3",
                    "status": "affected",
                    "version": "10.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "9.11.9",
                    "status": "affected",
                    "version": "9.11.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "10.6.0"
                  },
                  {
                    "status": "unaffected",
                    "version": "10.5.2"
                  },
                  {
                    "status": "unaffected",
                    "version": "10.4.4"
                  },
                  {
                    "status": "unaffected",
                    "version": "9.11.10"
                  }
                ]
              }
            ],
            "source": "responsibledisclosure@mattermost.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "73837B0A-0874-4B7D-8B09-D3CB7E249EA0",
                    "versionEndExcluding": "9.11.10",
                    "versionStartIncluding": "9.11.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "192A27FF-9A0C-4123-BCC2-CB0EB2754986",
                    "versionEndExcluding": "10.4.4",
                    "versionStartIncluding": "10.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "681C7A3F-D251-499D-80D4-0D971FA79B2D",
                    "versionEndExcluding": "10.5.2",
                    "versionStartIncluding": "10.5.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Mattermost versions 10.5.x \u003c= 10.5.1, 10.4.x \u003c= 10.4.3, 9.11.x \u003c= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived."
          },
          {
            "lang": "es",
            "value": "Las versiones de Mattermost 10.5.x \u0026lt;= 10.5.1, 10.4.x \u0026lt;= 10.4.3, 9.11.x \u0026lt;= 9.11.9 no marcan la configuraci\u00f3n \"Permitir a los usuarios ver canales archivados\" al obtener los metadatos del canal de una publicaci\u00f3n de canales archivados, lo que permite que los usuarios autenticados accedan a dicha informaci\u00f3n cuando un canal est\u00e1 archivado."
          }
        ],
        "id": "CVE-2025-27571",
        "lastModified": "2026-06-17T09:03:49.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "responsibledisclosure@mattermost.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-27571",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T14:19:48.223409Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-04-16T08:15:14.353",
        "references": [
          {
            "source": "responsibledisclosure@mattermost.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://mattermost.com/security-updates"
          }
        ],
        "sourceIdentifier": "responsibledisclosure@mattermost.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "responsibledisclosure@mattermost.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T18:03:31+00:00",
      "cve": "CVE-2025-27571",
      "id": "CVE-2025-27571",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Channel metadata visible in archived channels despite configuration setting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27571.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-27571",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-16T14:19:48.223409Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-16T14:22:56.742Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "10.5.1",
                  "status": "affected",
                  "version": "10.5.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.4.3",
                  "status": "affected",
                  "version": "10.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "9.11.9",
                  "status": "affected",
                  "version": "9.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "10.6.0"
                },
                {
                  "status": "unaffected",
                  "version": "10.5.2"
                },
                {
                  "status": "unaffected",
                  "version": "10.4.4"
                },
                {
                  "status": "unaffected",
                  "version": "9.11.10"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "hackit_bharat"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMattermost versions 10.5.x \u0026lt;= 10.5.1, 10.4.x \u0026lt;= 10.4.3, 9.11.x \u0026lt;= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.\u0026nbsp;\u003c/p\u003e"
                }
              ],
              "value": "Mattermost versions 10.5.x \u003c= 10.5.1, 10.4.x \u003c= 10.4.3, 9.11.x \u003c= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-04-16T07:45:58.802Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUpdate Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher.\u003c/p\u003e"
                }
              ],
              "value": "Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2025-00452",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-63192"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Channel metadata visible in archived channels despite configuration setting",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2025-27571",
        "datePublished": "2025-04-16T07:45:58.802Z",
        "dateReserved": "2025-04-08T07:50:19.660Z",
        "dateUpdated": "2025-04-16T14:34:19.313Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

CERTFR-2025-AVI-0217

Vulnerability from certfr_avis - Published: 2025-03-18 - Updated: 2025-04-17

De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mattermost	Mattermost Server	Mattermost Server versions 9.11.x antérieures à 9.11.10
Mattermost	Mattermost Server	Mattermost Server versions 10.4.x antérieures à 10.4.4
Mattermost	Mattermost Server	Mattermost Server versions 10.5.x antérieures à 10.5.2

References

Title

Publication Time

CNVD-2025-11083

Vulnerability from cnvd - Published: 2025-05-21

Title

Mattermost信息泄露漏洞（CNVD-2025-11083）

Description

Mattermost是美国Mattermost公司的一个开源协作平台。 Mattermost存在信息泄露漏洞，攻击者可利用该漏洞获取归档频道中的敏感信息。

Severity

中

Patch Name

Mattermost信息泄露漏洞（CNVD-2025-11083）的补丁

Patch Description

Mattermost是美国Mattermost公司的一个开源协作平台。 Mattermost存在信息泄露漏洞，攻击者可利用该漏洞获取归档频道中的敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网： https://mattermost.com/download/

Reference

https://mattermost.com/security-updates

Impacted products

Name
['Mattermost Mattermost >=10.5.x，<=10.5.1', 'Mattermost Mattermost >=10.4.x，<=10.4.3', 'Mattermost Mattermost >=9.11.x，<=9.11.9']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-27571",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-27571"
    }
  },
  "description": "Mattermost\u662f\u7f8e\u56fdMattermost\u516c\u53f8\u7684\u4e00\u4e2a\u5f00\u6e90\u534f\u4f5c\u5e73\u53f0\u3002\n\nMattermost\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u5f52\u6863\u9891\u9053\u4e2d\u7684\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://mattermost.com/download/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-11083",
  "openTime": "2025-05-21",
  "patchDescription": "Mattermost\u662f\u7f8e\u56fdMattermost\u516c\u53f8\u7684\u4e00\u4e2a\u5f00\u6e90\u534f\u4f5c\u5e73\u53f0\u3002\r\n\r\nMattermost\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u5f52\u6863\u9891\u9053\u4e2d\u7684\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Mattermost\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2025-11083\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Mattermost Mattermost \u003e=10.5.x\uff0c\u003c=10.5.1",
      "Mattermost Mattermost \u003e=10.4.x\uff0c\u003c=10.4.3",
      "Mattermost Mattermost \u003e=9.11.x\uff0c\u003c=9.11.9"
    ]
  },
  "referenceLink": "https://mattermost.com/security-updates",
  "serverity": "\u4e2d",
  "submitTime": "2025-04-22",
  "title": "Mattermost\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2025-11083\uff09"
}

FKIE_CVE-2025-27571

Vulnerability from fkie_nvd - Published: 2025-04-16 08:15 - Updated: 2026-06-17 09:03

Severity

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	responsibledisclosure@mattermost.com	https://mattermost.com/security-updates	Vendor Advisory

Impacted products

Vendor	Product	Version
mattermost	mattermost_server	*
mattermost	mattermost_server	*
mattermost	mattermost_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "10.5.1",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.4.3",
              "status": "affected",
              "version": "10.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.11.9",
              "status": "affected",
              "version": "9.11.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "10.6.0"
            },
            {
              "status": "unaffected",
              "version": "10.5.2"
            },
            {
              "status": "unaffected",
              "version": "10.4.4"
            },
            {
              "status": "unaffected",
              "version": "9.11.10"
            }
          ]
        }
      ],
      "source": "responsibledisclosure@mattermost.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73837B0A-0874-4B7D-8B09-D3CB7E249EA0",
              "versionEndExcluding": "9.11.10",
              "versionStartIncluding": "9.11.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "192A27FF-9A0C-4123-BCC2-CB0EB2754986",
              "versionEndExcluding": "10.4.4",
              "versionStartIncluding": "10.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "681C7A3F-D251-499D-80D4-0D971FA79B2D",
              "versionEndExcluding": "10.5.2",
              "versionStartIncluding": "10.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mattermost versions 10.5.x \u003c= 10.5.1, 10.4.x \u003c= 10.4.3, 9.11.x \u003c= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived."
    },
    {
      "lang": "es",
      "value": "Las versiones de Mattermost 10.5.x \u0026lt;= 10.5.1, 10.4.x \u0026lt;= 10.4.3, 9.11.x \u0026lt;= 9.11.9 no marcan la configuraci\u00f3n \"Permitir a los usuarios ver canales archivados\" al obtener los metadatos del canal de una publicaci\u00f3n de canales archivados, lo que permite que los usuarios autenticados accedan a dicha informaci\u00f3n cuando un canal est\u00e1 archivado."
    }
  ],
  "id": "CVE-2025-27571",
  "lastModified": "2026-06-17T09:03:49.180",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "responsibledisclosure@mattermost.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27571",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-16T14:19:48.223409Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-04-16T08:15:14.353",
  "references": [
    {
      "source": "responsibledisclosure@mattermost.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "sourceIdentifier": "responsibledisclosure@mattermost.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "responsibledisclosure@mattermost.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H4RR-F37J-4HH7

Vulnerability from github – Published: 2025-04-16 09:32 – Updated: 2025-04-23 15:17

Summary

Mattermost Incorrect Authorization vulnerability

Details

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.5.0"
            },
            {
              "fixed": "10.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.4.0"
            },
            {
              "fixed": "10.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.11.0"
            },
            {
              "fixed": "9.11.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0-20250314142426-c049748b8863"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27571"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-16T14:53:24Z",
    "nvd_published_at": "2025-04-16T08:15:14Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 10.5.x \u003c= 10.5.1, 10.4.x \u003c= 10.4.3, 9.11.x \u003c= 9.11.9 fail to check the \"Allow Users to View Archived Channels\" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.",
  "id": "GHSA-h4rr-f37j-4hh7",
  "modified": "2025-04-23T15:17:14Z",
  "published": "2025-04-16T09:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27571"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/341186355d982ac4cbe37668d7cdb0cf6275fe44"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/629f68a85dd6ed5ba0c51a9356c3a3200f50657f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/8e82d8df61068fc56b0f3e51ef1cc947bc87cec1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/ae8a952bcaaa5f77a92043e2538f625eac72e927"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/c6f6b664811795f36b9cf05b0e2b537c44c65bc1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3619"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost Incorrect Authorization vulnerability"
}

OPENSUSE-SU-2025:15017-1

Vulnerability from csaf_opensuse - Published: 2025-04-23 00:00 - Updated: 2026-09-20 21:31

Summary

govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media

Severity

Moderate

Scope

23 vulnerabilities in this advisory, including CVE-2025-27571.

CVE-2025-27571

Recommended: 4 products

Open the full advisory

WID-SEC-W-2025-0579

Vulnerability from csaf_certbund - Published: 2025-03-17 23:00 - Updated: 2025-04-22 22:00

Summary

Mattermost Server: Mehrere Schwachstellen

Severity

Mittel

Scope

7 vulnerabilities in this advisory, including CVE-2025-27571.

CVE-2025-27571

Known affected: 6 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-27571 (GCVE-0-2025-27571)

CERTFR-2025-AVI-0217

Solutions

CNVD-2025-11083

FKIE_CVE-2025-27571

GHSA-H4RR-F37J-4HH7

OPENSUSE-SU-2025:15017-1

WID-SEC-W-2025-0579

Tags

Sightings

Nomenclature

Related by attack behaviour