Access Control Vulnerability in Mattermost Product by Mattermost Inc.
CVE-2025-1792

3.1LOW

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
30 May 2025

What is CVE-2025-1792?

Mattermost is facing an access control vulnerability that allows authenticated guest users to improperly access sensitive metadata about members of public channels. This flaw arises from inadequate enforcement of access controls when using the channel members API endpoint. As a result, guest users may gain unauthorized insights into member details, which could lead to privacy breaches and misuse of information in collaborative environments.

Affected Version(s)

Mattermost 10.7.0

Mattermost 10.5.0 <= 10.5.3

Mattermost 9.11.0 <= 9.11.12

References

https://mattermost.com/security-updates

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bob10x1
.
CVE-2025-1792 : Access Control Vulnerability in Mattermost Product by Mattermost Inc.