VULNERABILITY INTELLIGENCE

CVE-2025-11777

CVSS score3.1 LOW
EPSS probability0.20%
CISA KEVNot currently listed
Published2025-11-13
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-863

Primary references