Servers and applications
CVE-2025-9076
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
- Severity
- Medium 6.5
- Published
- 15 Sept 2025
- Last changed
- 19 Oct 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 10.10.2
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MattermostServers and applications · cpe:a:mattermost:mattermost_server |
|