CVE-2025-11776
BaseFortify
Publication date: 2025-11-14
Last updated on: 2025-11-17
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | to 11.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost versions prior to 11, where the system does not properly restrict access to the archived channel search API. As a result, guest users can use the `/api/v4/teams/{team_id}/channels/search_archived` endpoint to discover archived public channels that they should not normally have access to.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized information disclosure, as guest users may gain access to information about archived public channels that are intended to be hidden. This could potentially expose sensitive or confidential information contained in those channels.