CVE-2025-27571
Channel metadata visible in archived channels despite configuration setting
Summary
Channel metadata visible in archived channels despite configuration setting
Original description
The description as published by the source.
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com