4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-27571

CVE-2025-27571: Mattermost Incorrect Authorization vulnerability

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-27571

CVE-2025-27571:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.5.0, < 10.5.2	10.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.4.0, < 10.4.4	10.4.4
github.com/mattermost/mattermost/server/v8	go	>= 9.11.0, < 9.11.10	9.11.10
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250314142426-c049748b8863	8.0.0-20250314142426-c049748b8863

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that Mattermost failed to check the 'Allow Users to View Archived Channels' configuration when fetching channel metadata of a post from archived channels. The provided patches (which are identical across the listed commits) modify server/channels/app/authorization.go. The primary change involves introducing a new helper function isChannelArchivedAndHidden(*model.Channel) bool which checks this specific configuration (!*a.Config().TeamSettings.ExperimentalViewArchivedChannels) in conjunction with whether a channel is deleted (channel.DeleteAt != 0). This helper function is then used to add a crucial check in two main authorization functions: (*App).SessionHasPermissionToChannel and (*App).SessionHasPermissionToChannels. The diffs show that the condition if a.isChannelArchivedAndHidden(channel) { return false } was added to these functions. Before this addition, these functions would proceed with other permission checks (like team membership or specific roles) without first verifying if the channel was archived and if the user was allowed to view archived channels. This omission is the root cause of the vulnerability, as these functions would incorrectly grant (or fail to deny) permissions for archived channels under certain circumstances. Other functions like (*App).HasPermissionToReadChannel and (*App).HasPermissionToChannelMemberCount were also modified to use this new helper function, but they already had an equivalent inline check (if !*a.Config().TeamSettings.ExperimentalViewArchivedChannels && channel.DeleteAt != 0). Their modification was primarily a refactoring to use the centralized helper and does not indicate they were the source of the missing check described in the vulnerability. The vulnerability was a failure to check, which was rectified by adding the check to SessionHasPermissionToChannel and SessionHasPermissionToChannels. Therefore, these two functions are identified as the vulnerable ones because they lacked the necessary authorization logic prior to the patch.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.