Mattermost Incorrect Authorization vulnerability

🗓️ 13 Nov 2025 18:31:05Reported by GitHub Advisory DatabaseType

Mattermost Incorrect Authorization flaw in Add Channel Member API enables cross‑team access to metadata and channel memberships.

Reporter	Title	Published	Views	Family All 23
Circl	CVE-2025-11777	13 Nov 202517:54	–	circl
CNNVD	Mattermost 安全漏洞	13 Nov 202500:00	–	cnnvd
CVE	CVE-2025-11777	13 Nov 202517:32	–	cve
Cvelist	CVE-2025-11777 Cross-team channel membership access	13 Nov 202517:32	–	cvelist
EUVD	EUVD-2025-175343	13 Nov 202518:31	–	euvd
Tenable Nessus	Mattermost Server 10.5.x < 10.5.12 / 10.11.x 10.11.4 / 11.0.0 Missing Authorization (MMSA-2025-00518)	20 Nov 202500:00	–	nessus
NVD	CVE-2025-11777	13 Nov 202518:15	–	nvd
OSV	GHSA-MQCJ-8C2G-H97Q Mattermost Incorrect Authorization vulnerability	13 Nov 202518:31	–	osv
OSV	GO-2025-4122 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost	17 Nov 202519:11	–	osv
OSV	SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb	6 Jan 202610:24	–	osv

Vulners

Node

mattermost mattermost-serverRange<5.3.2-0.20250905150616-ba86dfc5876bgo

mattermost mattermostRange<5.3.2-0.20250905150616-ba86dfc5876bgo

mattermost mattermostRange<8.0.0-20250905150616-ba86dfc5876bgo

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-11777
mattermost	www.mattermost.com/security-updates
github	www.github.com/mattermost/mattermost/commit/98acefe911dd9de7edf47a7d825dd99f53141a52
github	www.github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149
github	www.github.com/mattermost/mattermost/commit/d72d437f1567ba0b639b6e4fd73bab06c51baab5
github	www.github.com/advisories/GHSA-mqcj-8c2g-h97q

14 Nov 2025 15:54Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.13.1 - 4.3

EPSS0.00027

SSVC