medium6.5
CVE-2025-9076
Mattermost Missing Authorization vulnerability
Impact
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250729073403-517ae758cd02 | 8.0.0-20250729073403-517ae758cd02 |
| go | github.com/mattermost/mattermost-server | >= 10.10.0, < 10.10.2 | 10.10.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | from 10.10.0 before 10.10.2 |