CVE-2025-11777CWE-863broken-access-control

CVE-2025-11777

Low · published November 13, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
8.8
In the wild
Unconfirmed
What it is

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-13T23:15Z
Affected products (2)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.5.0, < 10.5.1210.5.12
mattermost/mattermost_server≥ 10.11.0, < 10.11.410.11.4
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 13 NOV 17:32Z
    Cross-team channel membership access
    cvelistv5