BaseFortify

Publication date: 2025-11-14

Last updated on: 2025-11-17

Assigner: Mattermost, Inc.

Description

Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-14

Last Modified

2025-11-17

Generated

2026-07-06

AI Q&A

2025-11-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-41436

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	to 11.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Mattermost versions prior to 11.0 allows regular users to bypass the intended restriction on viewing archived channels. Specifically, the setting that should prevent users from accessing archived channel content is not properly enforced, enabling users to access archived messages and files through the 'Open in Channel' feature from followed threads.

Impact Analysis

The vulnerability can lead to unauthorized access to archived channel content and files by regular users, potentially exposing sensitive or confidential information that was intended to be restricted. This could result in information leakage within an organization.

Hi! I’m here to help you understand CVE-2025-41436. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70