SUSE CVE-2025-24920

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

SUSE CVE-2025-25274

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

BIT-MATTERMOST-2025-24920

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

BIT-MATTERMOST-2025-25274

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 (MMSA-2025-00421)

The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, or 10.4.3. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00421 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command...

Mattermost Server 10.4.x < 10.4.3 / 10.3.x < 10.3.4 /9.11.x < 9.11.9 / 10.5.x < 10.5.1 (MMSA-2025-00432)

The version of Mattermost Server installed on the remote host is prior to 10.4.4 / 10.3.4 / 9.11.9 / 10.5.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00432 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the createChannelBookmark and updateChannelBookmark functions in channelbookmark.go. This allows attackers to create and update bookmarks on archived channels. Remediation Upgrade...

GO-2025-3550 Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server

Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization in the createChannelBookmark and updateChannelBookmark functions in...

GO-2025-3552 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server...

CVE-2025-24920

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

GHSA-RP74-X43M-CPW3 Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in command.go that allows a user to execute commands on archived channels. Remediation Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 9.11.9-rc1, 10.3.4, 10.4.3 or higher. References -...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization in command.go that allows a user to execute commands on archived...

Mattermost Fails to Restrict Command Execution in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

GHSA-4V65-XQCJ-WPGG Mattermost Fails to Restrict Command Execution in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-24920

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

CVE-2025-25274

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-24920

CVE-2025-24920 concerns Mattermost Server where versions 9.11.x ≤ 9.11.8, 10.3.x ≤ 10.3.3, 10.4.x ≤ 10.4.2, and 10.5.x ≤ 10.5.0 fail to restrict bookmark creation and updates in archived channels. The result is that authenticated users can create or update bookmarks within archived channels (per ...