CVE-2025-27933

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27933
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27933.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27933
Aliases
Downstream
Related
Published
2025-03-21T09:15:13.260Z
Modified
2026-04-10T05:24:20.063425Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

References

Affected packages

Git / github.com/mattermost/mattermost-server

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost-server
Events
Introduced
0bc2ddd42375a75ab14e63f038165150d4f07659
Fixed
07bb4f96ed7400080f2ded5e910a947b8e6c168f
Introduced
14facfa730253bbf4191d3346c2fd6f282c5b446
Fixed
d59bc01a0225a09819692671745d61b05ee949a0
Introduced
7c8c0b7464fa9cd2fbfb97c65d1475b4be2e765c
Fixed
e644e3c8e3931a9432bbd23ff6a219c5664011e9
Database specific 
{
    "versions": [
        {
            "introduced": "9.11.0"
        },
        {
            "fixed": "9.11.9"
        },
        {
            "introduced": "10.3.0"
        },
        {
            "fixed": "10.3.4"
        },
        {
            "introduced": "10.4.0"
        },
        {
            "fixed": "10.4.3"
        }
    ]
}

Affected versions

@mattermost/client@10.*
@mattermost/client@10.3.0
@mattermost/client@10.4.0
@mattermost/client@9.*
@mattermost/client@9.11.0
@mattermost/types@10.*
@mattermost/types@10.3.0
@mattermost/types@10.4.0
@mattermost/types@9.*
@mattermost/types@9.11.0
v10.*
v10.3.0
v10.3.1
v10.3.1-rc1
v10.3.2
v10.3.2-rc1
v10.3.2-rc2
v10.3.3
v10.3.4-rc1
v10.3.4-rc2
v10.3.4-rc3
v10.4.0
v10.4.0-rc3
v10.4.1
v10.4.2
v10.4.3-rc1
v10.4.3-rc2
v10.4.3-rc3
v9.*
v9.11.0
v9.11.0-rc3
v9.11.1
v9.11.1-rc1
v9.11.2
v9.11.2-rc1
v9.11.2-rc2
v9.11.3
v9.11.3-rc1
v9.11.3-rc2
v9.11.4
v9.11.4-rc1
v9.11.5
v9.11.5-rc1
v9.11.6
v9.11.6-rc1
v9.11.6-rc2
v9.11.7
v9.11.7-rc1
v9.11.7-rc2
v9.11.7-rc3
v9.11.8
v9.11.9-rc1
v9.11.9-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27933.json"