4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-2564

CVE-2025-2564: Mattermost Incorrect Authorization vulnerability

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-2564

CVE-2025-2564:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.5.0, < 10.5.2	10.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.4.0, < 10.4.4	10.4.4
github.com/mattermost/mattermost/server/v8	go	>= 9.11.0, < 9.11.10	9.11.10
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250314142426-c049748b8863	8.0.0-20250314142426-c049748b8863

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows users to view member information of archived channels even when the system setting 'Allow users to view/update archived channels' (internally ExperimentalViewArchivedChannels) is disabled. The provided commit ae8a952bcaaa5f77a92043e2538f625eac72e927 directly addresses this by modifying several authorization functions in server/channels/app/authorization.go. The changes involve introducing a new helper function isChannelArchivedAndHidden (which combines the channel's archived status channel.DeleteAt != 0 and the system setting !*a.Config().TeamSettings.ExperimentalViewArchivedChannels) and using it to enforce stricter checks in SessionHasPermissionToChannel, SessionHasPermissionToChannels, HasPermissionToReadChannel, and HasPermissionToChannelMemberCount. These functions, in their pre-patch state, lacked these comprehensive checks, leading to the incorrect authorization. The vulnerability description specifically mentions viewing 'members and member information', which aligns with the purpose of HasPermissionToReadChannel (general channel access) and HasPermissionToChannelMemberCount (specific to member counts). The SessionHasPermissionToChannel(s) functions are broader permission gates that would also be involved.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.