3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41436

CVE-2025-41436: Mattermost allows regular users to access archived channel content and files

Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41436

CVE-2025-41436:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	< 11.0.0-alpha.1	11.0.0-alpha.1
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250815165020-c8d66301415d	8.0.0-20250815165020-c8d66301415d

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-41436, allowed regular users to access content in archived channels, even when the system setting 'Allow users to view archived channels' was disabled. The exploit path involved the 'Open in Channel' feature for followed threads. The root cause was the inconsistent and bypassable enforcement of this configuration setting across the application.

The patch addresses this by completely removing the 'ExperimentalViewArchivedChannels' setting and its associated logic. The new behavior is to always allow users who were members of a channel before its archival to access its content. This simplifies the authorization model and eliminates the possibility of bypass.

The identified vulnerable functions are those that were responsible for enforcing the now-removed security control. For example, app.SessionHasPermissionToChannelByPost and api4.getPostsForChannel contained checks against ExperimentalViewArchivedChannels that were removed in the patch. These functions, and others like them, were part of the flawed security boundary that allowed unauthorized access to archived channel data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.