CVE-2025-41443
Guest user can discover active public channels
Résumé
Guest user can discover active public channels
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/{team_id}/channels/ids endpoint
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com