github.com/mattermost/mattermost/v5

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Medium 4.3

CVE-2025-11776

Guest user can discover archived public channels

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Nov 14, 2025
Low 3.1

CVE-2025-11777

Cross-team channel membership access

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the …

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

Nov 13, 2025