Skip to content
OpenAdvisories
Medium · 4.3 CVE-2025-11776 EUVD-2025-186558GHSA-j6gg-r5jc-47cmGO-2025-4126

Guest user can discover archived public channels

Published Nov 14, 2025 · Updated Nov 14, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Package: github.com/mattermost/mattermost/v5 Ecosystem: Go

Description

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

Affected products

VendorProductAffectedFixed
Mattermost Mattermost <11 – ≤ <11 11.0.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost < 5.3.2-0.20250815165020-c8d66301415d 5.3.2-0.20250815165020-c8d66301415d GHSA-j6gg-r5jc-47cm
Go github.com/mattermost/mattermost all versions — GO-2025-4126
Go github.com/mattermost/mattermost-server < 5.3.2-0.20250815165020-c8d66301415d 5.3.2-0.20250815165020-c8d66301415d GHSA-j6gg-r5jc-47cm
Go github.com/mattermost/mattermost-server all versions — GO-2025-4126
Go github.com/mattermost/mattermost-server/v5 < 5.3.2-0.20250815165020-c8d66301415d 5.3.2-0.20250815165020-c8d66301415d GHSA-j6gg-r5jc-47cm
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2025-4126
Go github.com/mattermost/mattermost-server/v6 < 5.3.2-0.20250815165020-c8d66301415d 5.3.2-0.20250815165020-c8d66301415d GHSA-j6gg-r5jc-47cm
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2025-4126
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250815165020-c8d66301415d 8.0.0-20250815165020-c8d66301415d GHSA-j6gg-r5jc-47cm
Go github.com/mattermost/mattermost/v5 all versions — GO-2025-4126

Advisories 2

References