Skip to content

x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-hc6v-386m-93pq #3730

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-hc6v-386m-93pq#3730
Assignees
thatnealpatel
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on May 30, 2025

Advisory GHSA-hc6v-386m-93pq references a vulnerability in the following Go modules:

Module
github.com/mattermost/mattermost-server
github.com/mattermost/mattermost-server/v5
github.com/mattermost/mattermost-server/v6
github.com/mattermost/mattermost/server/v8

Description:
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - introduced: 9.0.0-rc1+incompatible
        - fixed: 9.11.13+incompatible
        - introduced: 10.0.0-rc1+incompatible
        - fixed: 10.5.4+incompatible
        - introduced: 10.6.0-rc1+incompatible
        - fixed: 10.7.1+incompatible
      vulnerable_at: 10.7.0+incompatible
    - module: github.com/mattermost/mattermost-server/v5
      vulnerable_at: 5.39.3
    - module: github.com/mattermost/mattermost-server/v6
      vulnerable_at: 6.7.2
    - module: github.com/mattermost/mattermost/server/v8
      versions:
        - fixed: 8.0.0-20250414110750-c23f44fe8ed0
summary: Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-1792
ghsas:
    - GHSA-hc6v-386m-93pq
references:
    - advisory: https://github.com/advisories/GHSA-hc6v-386m-93pq
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-1792
    - fix: https://github.com/mattermost/mattermost/commit/c23f44fe8ed02f71d506f99adc30ad34c58c89d1
    - web: https://mattermost.com/security-updates
notes:
    - fix: 'github.com/mattermost/mattermost/server/v8: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
    id: GHSA-hc6v-386m-93pq
    created: 2025-05-30T19:04:39.427545001Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

Labels

triaged

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions