Low severityNVD Advisory· Published Nov 14, 2025· Updated Nov 14, 2025

Unauthorized access to archived channel content via threads interface

CVE-2025-41436

Description

Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/mattermost/mattermost-serverGo	< 11.0.0-alpha.1	11.0.0-alpha.1
github.com/mattermost/mattermost/server/v8Go	< 8.0.0-20250815165020-c8d66301415d	8.0.0-20250815165020-c8d66301415d

Affected products

ghsa-coords2 versions
pkg:golang/github.com/mattermost/mattermost-server pkg:golang/github.com/mattermost/mattermost/server/v8
< 11.0.0-alpha.1+ 1 more
- (no CPE)range: < 11.0.0-alpha.1
- (no CPE)range: < 8.0.0-20250815165020-c8d66301415d
Mattermost/Mattermostv5
Range: <11.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-x3hx-ch7p-8xggghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-41436ghsaADVISORY
github.com/mattermost/mattermost/commit/c8d66301415d5b447df0e829bdbaa92e8a83ecf8ghsaWEB
mattermost.com/security-updatesghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000