Servers and applications
CVE-2025-1792
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Severity
- Low 3.1
- Published
- 30 May 2025
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 9.11.13, 10.5.4, 10.7.1
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MattermostServers and applications · cpe:a:mattermost:mattermost_server |
|