CVE-2025-24526
Channel export permitted on archived channel when viewing archived channels is disabled
Summary
Channel export permitted on archived channel when viewing archived channels is disabled
Original description
The description as published by the source.
Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/mattermost/mattermost/server/v8
[{"type":"SEMVER","events":[{"introduced":"10.4.0-rc1"},{"fixed":"10.4.2"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web github.com
- web github.com
- web github.com
- web mattermost.com