CVE-2025-27933CWE-863

Unauthorized Private-to-Public Channel Conversion

Medium · published March 21, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-03-21T08:23Z
EPSS history
Timeline
  • 21 MAR 08:23Z
    Unauthorized Private-to-Public Channel Conversion
    cvelistv5