CVE-2025-1792CWE-863

Improper Access Control in Mattermost Channel Member API

Low · published May 30, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-05-30T14:22Z
EPSS history
Timeline
  • 30 MAY 14:22Z
    Improper Access Control in Mattermost Channel Member API
    cvelistv5