← Database

CVE-2025-41443

MEDIUM CVSS: 4.3 Published: 2025-10-16 Modified: 2026-06-17

Description

Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint

Affected Platforms

Mattermost Mattermost Server

Weakness Type

CWE-862

References