3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-11777

CVE-2025-11777: Mattermost Incorrect Authorization vulnerability

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-11777

CVE-2025-11777:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.4	10.11.4
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.12	10.5.12
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250905150616-ba86dfc5876b	8.0.0-20250905150616-ba86dfc5876b
github.com/mattermost/mattermost	go	< 5.3.2-0.20250905150616-ba86dfc5876b	5.3.2-0.20250905150616-ba86dfc5876b
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20250905150616-ba86dfc5876b	5.3.2-0.20250905150616-ba86dfc5876b
github.com/mattermost/mattermost-server/v5	go	< 5.3.2-0.20250905150616-ba86dfc5876b	5.3.2-0.20250905150616-ba86dfc5876b
github.com/mattermost/mattermost-server/v6	go	< 5.3.2-0.20250905150616-ba86dfc5876b	5.3.2-0.20250905150616-ba86dfc5876b

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an incorrect authorization issue in Mattermost's API, specifically affecting endpoints that return channel member information. The core of the issue is that the system was not properly checking if a user was authorized to view sensitive metadata (like LastViewedAt and LastUpdateAt) of other users, particularly across different teams. The provided patches address this by introducing a sanitization step. A new method, SanitizeForCurrentUser, was added to the ChannelMember model. This method redacts the LastViewedAt and LastUpdateAt fields if the channel member being processed is not the user making the request. This sanitization was then applied in multiple API handler functions, including addChannelMember, getChannelMembers, getChannelMembersByIds, getChannelMember, getChannelMembersForTeamForUser, and getChannelMembersForUser. Before the patch, these functions would return unsanitized data, leading to an information disclosure vulnerability. An attacker could call these API endpoints to gather activity information of users they should not have access to.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.