CVE-2025-24526: Mattermost fails to restrict channel export of archived channels
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.16425%
CWE
Published
2/24/2025
Updated
2/24/2025
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250110161910-96195f1bd746 | 8.0.0-20250110161910-96195f1bd746 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.11.0-rc1, < 9.11.8 | 9.11.8 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.2.0-rc1, < 10.2.3 | 10.2.3 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.3.0-rc1, < 10.3.3 | 10.3.3 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.4.0-rc1, < 10.4.2 | 10.4.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing authorization checks in the channel export handler. The fix in commit 3c052b6 added: 1) A configuration check for ExperimentalViewArchivedChannels 2) A channel archive status check using DeleteAt. The original vulnerable code lacked these checks, allowing exports of archived channels when view permissions were disabled. The tests added in api_test.go validate that the export is blocked when ExperimentalViewArchivedChannels=false and channel is archived, confirming the vulnerable flow was in the Export handler.