Low severity3.1NVD Advisory· Published Nov 14, 2025· Updated Jun 17, 2026
CVE-2025-41436
CVE-2025-41436
Description
Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost-serverGo | < 11.0.0-alpha.1 | 11.0.0-alpha.1 |
github.com/mattermost/mattermost/server/v8Go | < 8.0.0-20250815165020-c8d66301415d | 8.0.0-20250815165020-c8d66301415d |
Affected products
5<11.0+ 1 more
- (no CPE)range: <11.0
- cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*range: <11.0.0
- ghsa-coords3 versionspkg:golang/github.com/mattermost/mattermost-serverpkg:golang/github.com/mattermost/mattermost/server/v8pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 11.0.0-alpha.1+ 2 more
- (no CPE)range: < 11.0.0-alpha.1
- (no CPE)range: < 8.0.0-20250815165020-c8d66301415d
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-x3hx-ch7p-8xggghsaADVISORY
- mattermost.com/security-updatesnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-41436ghsaADVISORY
- github.com/mattermost/mattermost/commit/c8d66301415d5b447df0e829bdbaa92e8a83ecf8ghsaWEB
News mentions
0No linked articles in our index yet.