CVE-2025-27571
Channel metadata visible in archived channels despite configuration setting
Résumé
Channel metadata visible in archived channels despite configuration setting
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com