GHSA-7h34-9chr-58qh

Suggest an improvement
Source
https://github.com/advisories/GHSA-7h34-9chr-58qh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7h34-9chr-58qh/GHSA-7h34-9chr-58qh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7h34-9chr-58qh
Aliases
Published
2025-07-18T09:30:32Z
Modified
2025-07-29T19:44:30Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Mattermost Missing Authentication for Critical Function
Details

Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.

Database specific 
{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-21T18:32:06Z",
    "nvd_published_at":  "2025-07-18T09:15:26Z",
    "severity":  "MODERATE"
}
References

Affected packages

Go
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
10.5.0
Fixed
10.5.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7h34-9chr-58qh/GHSA-7h34-9chr-58qh.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
10.8.0
Fixed
10.8.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7h34-9chr-58qh/GHSA-7h34-9chr-58qh.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
10.7.0
Fixed
10.7.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7h34-9chr-58qh/GHSA-7h34-9chr-58qh.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
9.11.0
Fixed
9.11.17

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7h34-9chr-58qh/GHSA-7h34-9chr-58qh.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.0-20250520130510-fa40a8c5d47f

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-7h34-9chr-58qh/GHSA-7h34-9chr-58qh.json"