Skip to content

x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-3vcm-c42p-3hhf #3950

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/mattermost/mattermost-server: GHSA-3vcm-c42p-3hhf#3950
Assignees
thatnealpatel
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Sep 15, 2025

Advisory GHSA-3vcm-c42p-3hhf references a vulnerability in the following Go modules:

Module
github.com/mattermost/mattermost-server

Description:
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - introduced: 10.10.0+incompatible
        - fixed: 10.10.2+incompatible
      non_go_versions:
        - fixed: 8.0.0-20250729073403-517ae758cd02
      vulnerable_at: 10.10.2-rc4+incompatible
summary: Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-9076
ghsas:
    - GHSA-3vcm-c42p-3hhf
references:
    - advisory: https://github.com/advisories/GHSA-3vcm-c42p-3hhf
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-9076
    - web: https://mattermost.com/security-updates
source:
    id: GHSA-3vcm-c42p-3hhf
    created: 2025-09-15T21:01:36.935026794Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

Labels

triaged

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions