Description
Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 9.11.0 – ≤ 9.11.8 | 10.5.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250327T184518-1.1 | openSUSE-SU-2025:14937-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | >= 9.11.0, < 9.11.9 | 9.11.9 | GHSA-fqrq-xmxj-v47x |
| Go | github.com/mattermost/mattermost-server | >= 9.11.0+incompatible, < 9.11.9+incompatible | 9.11.9+incompatible | GO-2025-3534 |
| Go | github.com/mattermost/mattermost-server/v5 | all versions | — | GO-2025-3534 |
| Go | github.com/mattermost/mattermost-server/v6 | all versions | — | GO-2025-3534 |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.9 | 9.11.9 | GHSA-fqrq-xmxj-v47x |
| Go | github.com/mattermost/mattermost/server/v8 | all versions | — | GO-2025-3534 |
Advisories 2
- openSUSE-SU-2025:14937-1 govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0410 Mattermost: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025