Cloudanix VulnDB

CVE-2025-11777

Low · 3.1

Mattermost Incorrect Authorization vulnerability

CVSS

3.1

EPSS

0.2%

Published

Nov 13, 2025

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost 0 No fix
Go github.com/mattermost/mattermost 0 5.3.2-0.20250905150616-ba86dfc5876b
Go github.com/mattermost/mattermost-server 0 5.3.2-0.20250905150616-ba86dfc5876b
Go github.com/mattermost/mattermost-server 10.11.0 10.11.4
Go github.com/mattermost/mattermost-server 10.5.0 10.5.12
Go github.com/mattermost/mattermost-server 10.5.0+incompatible 10.5.12+incompatible
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v5 0 5.3.2-0.20250905150616-ba86dfc5876b
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 5.3.2-0.20250905150616-ba86dfc5876b
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20250905150616-ba86dfc5876b
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20251212204551-54f2e9b4afd5
Go github.com/mattermost/mattermost/v5 0 No fix
go github.com/mattermost/mattermost-server 10.11.0 10.11.4
go github.com/mattermost/mattermost-server 10.5.0 10.5.12
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251230T014957-150000.1.134.1

Related vulnerabilities