Description
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 10.5.0 – ≤ 10.5.5, 9.11.0 – ≤ 9.11.15, 10.8.0, 10.7.0 – ≤ 10.7.2, 10.6.0 – ≤ 10.6.5 | 10.9.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250730T213748-1.1 | openSUSE-SU-2025:15405-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | < 0.0.0-20250520060012-d0380305ef7a | 0.0.0-20250520060012-d0380305ef7a | GHSA-qwwm-c582-82rx |
| Go | github.com/mattermost/mattermost-server | < 0.0.0-20250520060012-d0380305ef7a · >= 9.11.0+incompatible, < 9.11.16+incompatible · >= 10.5.0+incompatible, < 10.5.6+incompatible · >= 10.6.0+incompatible, < 10.6.6+incompatible · >= 10.7.0+incompatible, < 10.7.3+incompatible · >= 10.8.0+incompatible, < 10.8.1+incompatible | 0.0.0-20250520060012-d0380305ef7a, 9.11.16+incompatible, 10.5.6+incompatible, 10.6.6+incompatible, 10.7.3+incompatible, 10.8.1+incompatible | GO-2025-3772 |
| Go | github.com/mattermost/mattermost-server/v5 | all versions | — | GO-2025-3772 |
| Go | github.com/mattermost/mattermost-server/v6 | all versions | — | GO-2025-3772 |
| Go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250520060012-d0380305ef7a | 8.0.0-20250520060012-d0380305ef7a | GHSA-qwwm-c582-82rx |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.5.0, < 10.5.6 | 10.5.6 | GHSA-qwwm-c582-82rx |
| Go | github.com/mattermost/mattermost/server/v8 | >= 9.11.0, < 9.11.16 | 9.11.16 | GHSA-qwwm-c582-82rx |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.8.0, < 10.8.1 | 10.8.1 | GHSA-qwwm-c582-82rx |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.7.0, < 10.7.3 | 10.7.3 | GHSA-qwwm-c582-82rx |
| Go | github.com/mattermost/mattermost/server/v8 | >= 10.6.0, < 10.6.6 | 10.6.6 | GHSA-qwwm-c582-82rx |
Advisories 1
- openSUSE-SU-2025:15405-1 govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026