CVE-2025-14350CWE-862

Information disclosure via channel mentions in posts

Medium · published February 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-16T12:05Z
EPSS history
Timeline
  • 16 FEB 12:05Z
    Information disclosure via channel mentions in posts
    cvelistv5