4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41443

CVE-2025-41443: Mattermost has a Missing Authorization vulnerability

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/{team_id}/channels/ids endpoint

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41443

CVE-2025-41443:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250822090405-e8c7e7d0252b	8.0.0-20250822090405-e8c7e7d0252b
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.11	10.5.11
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.3	10.11.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a missing authorization check in Mattermost that allows guest users to discover public channels they are not members of via the /api/v4/teams/{team_id}/channels/ids endpoint. The provided commit e8c7e7d0252bbf1e098aae4a5ea05d945afd7e70 directly addresses this issue.

The analysis of the commit's diff reveals a change in server/channels/api4/channel.go, specifically within the getPublicChannelsByIdsForTeam function. This function is the handler for the vulnerable API endpoint. The patch introduces a new block of code that checks if the current user's session belongs to a guest. If it does, it iterates through the channels being requested and verifies that the guest user has the PermissionReadChannel permission for each one. If the permission is missing for any channel, it returns a permission error.

The absence of this check in vulnerable versions is the root cause of the security issue. Therefore, the getPublicChannelsByIdsForTeam function is identified as the vulnerable function. During exploitation, a stack trace or profiler would show this function being executed when a malicious request is made by a guest user to the vulnerable endpoint.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.