GHSA-3vcm-c42p-3hhf

Source

https://github.com/advisories/GHSA-3vcm-c42p-3hhf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-3vcm-c42p-3hhf/GHSA-3vcm-c42p-3hhf.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-3vcm-c42p-3hhf

Aliases

CVE-2025-9076

Published

2025-09-15T12:31:24Z

Modified

2025-09-15T21:27:26.941794Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Mattermost Missing Authorization vulnerability

Details

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

Database specific

{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T20:38:31Z",
    "nvd_published_at": "2025-09-15T10:15:32Z"
}

References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.0-20250729073403-517ae758cd02

Go / github.com/mattermost/mattermost-server

Package

Name: github.com/mattermost/mattermost-server; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type: SEMVER
Events: Introduced

10.10.0

Fixed

10.10.2