-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in the channel export handler. The fix in commit 3c052b6 added: 1) A configuration check for ExperimentalViewArchivedChannels 2) A channel archive status check using DeleteAt. The original vulnerable code lacked these checks, allowing exports of archived channels when view permissions were disabled. The tests added in api_test.go validate that the export is blocked when ExperimentalViewArchivedChannels=false and channel is archived, confirming the vulnerable flow was in the Export handler.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250110161910-96195f1bd746 | 8.0.0-20250110161910-96195f1bd746 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.11.0-rc1, < 9.11.8 | 9.11.8 |
| github.com/mattermost/mattermost/server/v8 |
| go |
| >= 10.2.0-rc1, < 10.2.3 |
| 10.2.3 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.3.0-rc1, < 10.3.3 | 10.3.3 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.4.0-rc1, < 10.4.2 | 10.4.2 |
Ongoing coverage of React2Shell