Medium severity4.3NVD Advisory· Published Jun 30, 2025· Updated Jun 17, 2026
CVE-2025-47871
CVE-2025-47871
Description
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost-serverGo | < 0.0.0-20250513065225-4ae5d647fb88 | 0.0.0-20250513065225-4ae5d647fb88 |
github.com/mattermost/mattermost/server/v8Go | < 8.0.0-20250513065225-4ae5d647fb88 | 8.0.0-20250513065225-4ae5d647fb88 |
github.com/mattermost/mattermost/server/v8Go | >= 9.11.0, < 9.11.16 | 9.11.16 |
github.com/mattermost/mattermost/server/v8Go | >= 10.5.0, < 10.5.6 | 10.5.6 |
github.com/mattermost/mattermost/server/v8Go | >= 10.6.0, < 10.6.6 | 10.6.6 |
github.com/mattermost/mattermost/server/v8Go | >= 10.7.0, < 10.7.3 | 10.7.3 |
github.com/mattermost/mattermost/server/v8Go | >= 10.8.0, < 10.8.1 | 10.8.1 |
Affected products
910.5.0+ 5 more
- (no CPE)range: 10.5.0
- cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*range: >=9.11.0,<9.11.16
- cpe:2.3:a:mattermost:mattermost_server:10.8.0:-:*:*:*:*:*:*
- cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mattermost:mattermost_server:10.8.0:rc3:*:*:*:*:*:*
- ghsa-coords3 versionspkg:golang/github.com/mattermost/mattermost-serverpkg:golang/github.com/mattermost/mattermost/server/v8pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 0.0.0-20250513065225-4ae5d647fb88+ 2 more
- (no CPE)range: < 0.0.0-20250513065225-4ae5d647fb88
- (no CPE)range: < 8.0.0-20250513065225-4ae5d647fb88
- (no CPE)range: < 0.0.20250730T213748-1.1
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-wgvp-jj4w-88hfghsaADVISORY
- mattermost.com/security-updatesnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-47871ghsaADVISORY
News mentions
0No linked articles in our index yet.