VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 16, 2025· Updated Apr 17, 2025

Unauthorized View Access to Archived Channel Member Info

CVE-2025-2564

Description

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/mattermost/mattermost/server/v8Go
>= 10.5.0, < 10.5.210.5.2
github.com/mattermost/mattermost/server/v8Go
>= 10.4.0, < 10.4.410.4.4
github.com/mattermost/mattermost/server/v8Go
>= 9.11.0, < 9.11.109.11.10
github.com/mattermost/mattermost/server/v8Go
< 8.0.0-20250314142426-c049748b88638.0.0-20250314142426-c049748b8863

Affected products

11

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.