Headline
GHSA-mqcj-8c2g-h97q: Mattermost Incorrect Authorization vulnerability
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
Package
gomod github.com/mattermost/mattermost (Go)
Affected versions
< 5.3.2-0.20250905150616-ba86dfc5876b
Patched versions
5.3.2-0.20250905150616-ba86dfc5876b
gomod github.com/mattermost/mattermost-server (Go)
>= 10.11.0, < 10.11.4
>= 10.5.0, < 10.5.12
< 5.3.2-0.20250905150616-ba86dfc5876b
10.11.4
10.5.12
5.3.2-0.20250905150616-ba86dfc5876b
gomod github.com/mattermost/mattermost-server/v5 (Go)
< 5.3.2-0.20250905150616-ba86dfc5876b
5.3.2-0.20250905150616-ba86dfc5876b
gomod github.com/mattermost/mattermost-server/v6 (Go)
< 5.3.2-0.20250905150616-ba86dfc5876b
5.3.2-0.20250905150616-ba86dfc5876b
gomod github.com/mattermost/mattermost/server/v8 (Go)
< 8.0.0-20250905150616-ba86dfc5876b
8.0.0-20250905150616-ba86dfc5876b