GHSA-x3hx-ch7p-8xgg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-x3hx-ch7p-8xgg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-x3hx-ch7p-8xgg/GHSA-x3hx-ch7p-8xgg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-x3hx-ch7p-8xgg
- Aliases
-
- CVE-2025-41436
- GO-2025-4131
- Downstream
- Published
- 2025-11-14T09:30:27Z
- Modified
- 2025-11-18T16:14:00Z
- Severity
-
- 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Mattermost allows regular users to access archived channel content and files
- Details
-
Mattermost versions < 11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
- Database specific
{ "cwe_ids": [ "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2025-11-17T17:50:34Z", "nvd_published_at": "2025-11-14T08:15:45Z", "severity": "LOW" }- References
Affected packages
Go / github.com/mattermost/mattermost-server
Package
- Name
- github.com/mattermost/mattermost-server
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/mattermost/mattermost-server
Go / github.com/mattermost/mattermost/server/v8
Package
- Name
- github.com/mattermost/mattermost/server/v8
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/mattermost/mattermost/server/v8