CVE-2025-41436

Low · 3.1

Mattermost allows regular users to access archived channel content and files

CVSS

3.1

EPSS

0.2%

Published

Nov 14, 2025

CISA due date

—

The record

Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

Affected packages

Ecosystem	Package	Fixed
Go	github.com/mattermost/mattermost-server	11.0.0-alpha.1
Go	github.com/mattermost/mattermost-server	11.0.0-alpha.1+incompatible
Go	github.com/mattermost/mattermost-server/v5	No fix
Go	github.com/mattermost/mattermost-server/v6	No fix
Go	github.com/mattermost/mattermost/server/v8	8.0.0-20250815165020-c8d66301415d

Related vulnerabilities

GO-2026-4305 Mattermost Server vulnerable to CSRF if CORS is enabled in… Also affects github.com/mattermost/mattermost-server
GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as… Also affects github.com/mattermost/mattermost-server
GO-2026-4326 Mattermost is vulnerable to DoS due to infinite re-renders on API errors in… Also affects github.com/mattermost/mattermost-server
GO-2025-4260 Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created… Also affects github.com/mattermost/mattermost-server
GO-2026-4325 Mattermost is vulnerable to CPU exhaustion via crafted HTTP request in… Also affects github.com/mattermost/mattermost-server
GO-2026-4282 Mattermost Server is vulnerable to channel invisibility DoS via misformatted post in… Also affects github.com/mattermost/mattermost-server
GO-2026-4496 Mattermost doesn't validate user permissions when creating Jira issues from Mattermost… Also affects github.com/mattermost/mattermost-server
GO-2026-4520 Mattermost fails to properly validate login method restrictions in… Also affects github.com/mattermost/mattermost-server