Channel Conversion Vulnerability in Mattermost by Mattermost Inc.

CVE-2025-27933

Summary

Mattermost versions 10.4.x (up to 10.4.2), 10.3.x (up to 10.3.3), and 9.11.x (up to 9.11.8) have a misconfiguration that fails to enforce necessary restrictions on channel conversions. This oversight permits users with the ability to convert public channels to private ones to also mistakenly alter private channels back into public, potentially leading to unintentional exposure of sensitive information. Organizations using these versions are advised to review their channel management policies and apply necessary updates to mitigate this risk.

References