Mattermost allows unauthorized channel member management through playbook runs

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

CVE-2025-3227 Unauthorized channel member management through playbook runs

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

CVE-2025-3227

Mattermost CVE-2025-3227 affects multiple releases (10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x

PT-2025-26324 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.5.x through 10.5.5 Mattermost versions 10.6.x through 10.6.5 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.8.x through 10.8.0 Description: The issue is relat...

CVE-2021-21431

sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from oth...

SUSE CVE-2022-49909

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2025-18626 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free issue has been identified in the Linux kernel's Bluetooth L2CAP implementation. This occurs when the l2cap recv frame function is invoked to receive data, and the...

CVE-2025-21799 net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65cpswnussremovetxchns When getting the IRQ we use k3udmagluetxgetirq which returns negative error value on error. So not NULL check is not sufficient to deteremine if IRQ is...

DEBIAN-CVE-2024-57991

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: chan: fix soft lockup in rtw89entityrecalcmgntroles During rtw89entityrecalcmgntroles, there is a normalizing process which will re-order the list if an entry with target pattern is found. And once one is found, shou...

CVE-2024-57991

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: chan: fix soft lockup in rtw89entityrecalcmgntroles During rtw89entityrecalcmgntroles, there is a normalizing process which will re-order the list if an entry with target pattern is found. And once one is found, shou...

CVE-2024-39905

The CVE-2024-39905 issue affects Red-DiscordBot caused by a bug in Red’s Core API: 3rd-party cogs using the can_manage_channel permission check may allow a user to run a command without channel management rights. Core commands/cogs are not affected. The vulnerability was patched in version 3.5.10...

SQL Injection Vulnerability in U8+ Channel Management of UFIDA Network Technology Co.

Founded in 1988, UFIDA is a leading global provider of enterprise cloud services and software. A SQL injection vulnerability exists in UFIDA U8+ Channel Management, which can be exploited by attackers to obtain sensitive information from the database...

VulnCheck KEV: CVE-2020-15251

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

PYSEC-2021-58

sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from oth...

CVE-2021-21431 Improper Input Validation in sopel-plugins.channelmgnt

sopel-channelmgnt is a channelmgnt plugin for sopel. In versions prior to 2.0.1, on some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once. We also believe it may have been possible to remove users from oth...

sario528 sopel-channelmgnt 安全漏洞

sario528 sopel-channelmgnt is a sario528 open source application plugin . Channelmgnt plugin for Sopel. sopel-channelmgnt version 2.0.1 and earlier versions of a security vulnerability , the vulnerability stems from the simultaneous kick of multiple users , you can bypass the use of kick kickban...

PT-2021-14503 · Unknown · Sopel-Channelmgnt

Name of the Vulnerable Software and Affected Versions: sopel-channelmgnt versions prior to 2.0.1 Description: The issue concerns the sopel-channelmgnt plugin for sopel, where restrictions around the removal of the bot using the kick/kickban command could be bypassed on some IRC servers when kicki...

CVE-2020-15251

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

UBUNTU-CVE-2020-15251

In the Channelmgnt plug-in for Sopel a Python IRC bot before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2 affected. Version 9.0.2...

Privilege Escalation in Channelmgnt plug-in for Sopel

Impact Malicious users are able to op/voice and take over a channel Patches On version 1.0.3 Workarounds Disable channelmgnt References https://phab.bots.miraheze.wiki/T117 For more information If you have any questions or comments about this advisory: Email us at staffatmirahezebotsdotorg...