Moderate severityNVD Advisory· Published Feb 16, 2026· Updated Feb 17, 2026
Information disclosure via channel mentions in posts
CVE-2025-14350
Description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go | < 8.0.0-20251209134645-761e56bb11cc | 8.0.0-20251209134645-761e56bb11cc |
github.com/mattermost/mattermost-serverGo | >= 11.1.0 | — |
github.com/mattermost/mattermost-serverGo | >= 10.11.0 | — |
github.com/mattermost/mattermost-serverGo | >= 11.2.0 | — |
github.com/mattermost/mattermost-serverGo | < 5.3.2-0.20251209134645-761e56bb11cc | 5.3.2-0.20251209134645-761e56bb11cc |
Affected products
4- ghsa-coords3 versionspkg:golang/github.com/mattermost/mattermost-serverpkg:golang/github.com/mattermost/mattermost/server/v8pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
>= 11.1.0+ 2 more
- (no CPE)range: >= 11.1.0
- (no CPE)range: < 8.0.0-20251209134645-761e56bb11cc
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- Range: 11.1.0
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-57cc-2pf4-mhmxghsaADVISORY
- mattermost.com/security-updatesghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-14350ghsaADVISORY
- github.com/mattermost/mattermost/commit/761e56bb11ccb751ddbe4bab5898ccc2b384fd82ghsaWEB
News mentions
0No linked articles in our index yet.