CVE-2025-41443CWE-862broken-access-control

CVE-2025-41443

Medium · published October 16, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-10-16T12:15Z
Affected products (2)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.5.0, < 10.5.1110.5.11
mattermost/mattermost_server≥ 10.11.0, < 10.11.310.11.3
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 16 OCT 08:10Z
    Guest user can discover active public channels
    cvelistv5