Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization in command.go that allows a user to execute commands on archived...

GHSA-4V65-XQCJ-WPGG Mattermost Fails to Restrict Command Execution in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-24920

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

CVE-2025-25274

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-24920 Unauthorized Bookmark Creation and Modification in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

CVE-2025-24920 Unauthorized Bookmark Creation and Modification in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

CVE-2025-24920 Unauthorized Bookmark Creation and Modification in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels...

CVE-2025-24920

CVE-2025-24920 concerns Mattermost Server where versions 9.11.x ≤ 9.11.8, 10.3.x ≤ 10.3.3, 10.4.x ≤ 10.4.2, and 10.5.x ≤ 10.5.0 fail to restrict bookmark creation and updates in archived channels. The result is that authenticated users can create or update bookmarks within archived channels (per ...

CVE-2025-25274 Unauthorized Command Execution in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-25274

Mattermost Server contains a vulnerability CVE-2025-25274 in archived channels: versions 10.4.x (≤10.4.2), 10.3.x (≤10.3.3), and 9.11.x (≤9.11.8) fail to restrict command execution, allowing authenticated users to run commands in archived channels. Root cause is improper access control around arc...

CVE-2025-25274 Unauthorized Command Execution in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-25274 Unauthorized Command Execution in Archived Channels

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels...

CVE-2025-27933

Mattermost CVE-2025-27933 affects Mattermost Server 9.11.x <= 9.11.8, 10.3.x <= 10.3.3, and 10.4.x

CVE-2025-27715 Auto-Enrollment of Team Admins into Private Channels without explicit consent

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from Unrestricted creation and updating of bookmarks in archive channels, which allows authenticated users to create or update bookmarks in...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in model/role.go. A user with the Viewer role, configured with No Access to Reporting, can access team and site statistics...

PT-2025-46946

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11.0 Description Mattermost fails to correctly implement the "Allow users to view archived channels" setting. This allows regular users to access content and files within archived channels through the "Open in...

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Description: The feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the findsecurepivot function and potentially other parts of securematrixsolve. These vulnerabilities are due to Python's execution model, which does not guarantee...

CVE-2025-29780 Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing VSS scheme. In versions 0.8.0b2 and prior, the feldmanvss library contains timing side-channel vulnerabilities in its matrix operations, specifically within the...