Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when an admin user adds itself to a private channel by clicking a permalink. Remediation Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 9.11.9-rc1 or higher. References - GitHub Commit...

GHSA-CW7Q-5CGC-H3H9 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization when an admin user adds itself to a private channel by clicking a...

CVE-2025-27715

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

CVE-2025-27715 Auto-Enrollment of Team Admins into Private Channels without explicit consent

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

CVE-2025-27715 Auto-Enrollment of Team Admins into Private Channels without explicit consent

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from an unenforced channel switching restriction that allows a member with privileges to switch a public channel to a private channel or a priva...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost version 9.11.8 and earlier, which stems from failing to prompt for explicit approval before adding team administrators to a private channel, allowing team...

CVE-2025-25195

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

SUSE CVE-2024-10241

Mattermost versions 9.5.x = 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K...

CVE-2025-25195

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

CVE-2025-25195

Zulip vulnerability CVE-2025-25195 involves a logic flaw in the weekly cron job that demotes channels to “inactive” after 180 days. When a private channel is demoted, an event revealing the private channel name is accidentally broadcast to all users in the organization, and the system also leaks ...

CVE-2025-25195 Zulip events can leak private channel names

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

CVE-2025-25195 Zulip events can leak private channel names

Zulip is an open source team chat application. A weekly cron job added in 50256f48314250978f521ef439cafa704e056539 demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization, not just users in...

Zulip 信息泄露漏洞

Zulip is a powerful open source group chat application from Zulip, Inc. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip suffers from an information disclosure vulnerability that stems from not properly limiting the scope of...

PT-2025-7053 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip affected versions not specified Description: A weekly cron job in Zulip demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization,...

Mattermost Server 9.11.x < 9.11.3, 10.0.x < 10.0.1, 10.1.0 (MMSA-2024-00385)

The version of Mattermost Server installed on the remote host is prior to 9.11.3, 10.0.1 or 10.1.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00385 advisory. - Mattermost versions 10.0.x = 10.0.0 and 9.11.x = 9.11.2 fail to properly query ElasticSearch when...

Mattermost Access Control Error Vulnerability (CNVD-2024-45313)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an Access Control Error vulnerability that stems from a failure to properly query ElasticSearch when searching for a channel name in the channel switcher, which can be exploited...

Improper Access Control

Mattermost is vulnerable to Improper Access Control. The vulnerability is due to improper filtering of channel data when ElasticSearch is enabled, allowing users to access private channel names by using cmd+K/ctrl+K...