{"id":"EUVD-2025-34731","enisaUuid":"8265b981-68c0-34a3-bb4d-0a431bb5509f","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.12, 10.11.x \u003c\u003d 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint","datePublished":"Oct 16, 2025, 8:10:40 AM","dateUpdated":"Oct 29, 2025, 8:06:29 AM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-41443\nGHSA-7cr3-38jm-6p45\n","assigner":"Mattermost","epss":0.31,"enisaIdProduct":[{"id":"c35d9926-db4d-3679-ae3c-07112751daf8","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.2"},{"id":"d212ce7b-9bd8-35df-ba43-d9f6f8c5b3a4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.12"}],"enisaIdVendor":[{"id":"49e38ce1-8819-3fe6-b476-b9228eb14513","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"096eb8ba-6379-35f7-b2ae-361d0db2d9e3","vulnerability":{"id":"CVE-2025-41443","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.12, 10.11.x \u003c\u003d 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint","datePublished":"Oct 16, 2025, 8:10:40 AM","dateUpdated":"Oct 29, 2025, 8:06:29 AM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-34731\n","assigner":"Mattermost","epss":0.31,"dataProcessed":"Nov 6, 2026, 7:13:59 AM","vulnerabilityProduct":[{"id":"58a84482-e587-3bd0-b09e-30cefd181886","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.12"},{"id":"bdc115ad-15f7-3984-8d84-b0e7afba957c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.2"}],"vulnerabilityVendor":[{"id":"4f6bcf64-fed2-3f7b-a0f4-9c260f0715bf","vendor":{"name":"Mattermost"}}]}},{"id":"4d69c06e-4920-390a-8c5c-e95df40ea840","vulnerability":{"id":"GHSA-7cr3-38jm-6p45","description":"Mattermost has a Missing Authorization vulnerability","datePublished":"Oct 16, 2025, 9:30:24 AM","dateUpdated":"Oct 16, 2025, 8:54:54 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-41443\nhttps://github.com/mattermost/mattermost/pull/31327\nhttps://github.com/mattermost/mattermost/pull/33778\nhttps://github.com/mattermost/mattermost/commit/e8c7e7d0252bbf1e098aae4a5ea05d945afd7e70\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-34731\n","aliases":"CVE-2025-41443\nGHSA-7cr3-38jm-6p45\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"88a47443-6922-3504-875e-e6520c98e89f","advisory":{"id":"openSUSE-SU-2025:15710-1","description":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","datePublished":"Nov 7, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:44:36 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15710-1.json\nhttps://www.suse.com/security/cve/CVE-2016-11063/\nhttps://www.suse.com/security/cve/CVE-2016-11066/\nhttps://www.suse.com/security/cve/CVE-2016-11067/\nhttps://www.suse.com/security/cve/CVE-2016-11068/\nhttps://www.suse.com/security/cve/CVE-2016-11069/\nhttps://www.suse.com/security/cve/CVE-2016-11070/\nhttps://www.suse.com/security/cve/CVE-2016-11071/\nhttps://www.suse.com/security/cve/CVE-2016-11072/\nhttps://www.suse.com/security/cve/CVE-2016-11073/\nhttps://www.suse.com/security/cve/CVE-2016-11074/\nhttps://www.suse.com/security/cve/CVE-2016-11075/\nhttps://www.suse.com/security/cve/CVE-2016-11076/\nhttps://www.suse.com/security/cve/CVE-2016-11077/\nhttps://www.suse.com/security/cve/CVE-2016-11078/\nhttps://www.suse.com/security/cve/CVE-2016-11079/\nhttps://www.suse.com/security/cve/CVE-2016-11080/\nhttps://www.suse.com/security/cve/CVE-2016-11081/\nhttps://www.suse.com/security/cve/CVE-2016-11082/\nhttps://www.suse.com/security/cve/CVE-2016-11083/\nhttps://www.suse.com/security/cve/CVE-2016-11084/\nhttps://www.suse.com/security/cve/CVE-2017-18872/\nhttps://www.suse.com/security/cve/CVE-2023-32199/\nhttps://www.suse.com/security/cve/CVE-2024-58269/\nhttps://www.suse.com/security/cve/CVE-2025-10545/\nhttps://www.suse.com/security/cve/CVE-2025-10678/\nhttps://www.suse.com/security/cve/CVE-2025-10954/\nhttps://www.suse.com/security/cve/CVE-2025-11374/\nhttps://www.suse.com/security/cve/CVE-2025-11375/\nhttps://www.suse.com/security/cve/CVE-2025-11579/\nhttps://www.suse.com/security/cve/CVE-2025-11621/\nhttps://www.suse.com/security/cve/CVE-2025-12044/\nhttps://www.suse.com/security/cve/CVE-2025-26625/\nhttps://www.suse.com/security/cve/CVE-2025-27093/\nhttps://www.suse.com/security/cve/CVE-2025-41410/\nhttps://www.suse.com/security/cve/CVE-2025-41443/\nhttps://www.suse.com/security/cve/CVE-2025-54286/\nhttps://www.suse.com/security/cve/CVE-2025-54287/\nhttps://www.suse.com/security/cve/CVE-2025-54288/\nhttps://www.suse.com/security/cve/CVE-2025-54289/\nhttps://www.suse.com/security/cve/CVE-2025-54290/\nhttps://www.suse.com/security/cve/CVE-2025-54291/\nhttps://www.suse.com/security/cve/CVE-2025-54293/\nhttps://www.suse.com/security/cve/CVE-2025-54469/\nhttps://www.suse.com/security/cve/CVE-2025-54470/\nhttps://www.suse.com/security/cve/CVE-2025-54471/\nhttps://www.suse.com/security/cve/CVE-2025-54499/\nhttps://www.suse.com/security/cve/CVE-2025-58073/\nhttps://www.suse.com/security/cve/CVE-2025-58075/\nhttps://www.suse.com/security/cve/CVE-2025-58356/\nhttps://www.suse.com/security/cve/CVE-2025-59043/\nhttps://www.suse.com/security/cve/CVE-2025-59048/\nhttps://www.suse.com/security/cve/CVE-2025-59530/\nhttps://www.suse.com/security/cve/CVE-2025-59836/\nhttps://www.suse.com/security/cve/CVE-2025-59937/\nhttps://www.suse.com/security/cve/CVE-2025-61141/\nhttps://www.suse.com/security/cve/CVE-2025-61524/\nhttps://www.suse.com/security/cve/CVE-2025-61581/\nhttps://www.suse.com/security/cve/CVE-2025-61688/\nhttps://www.suse.com/security/cve/CVE-2025-62156/\nhttps://www.suse.com/security/cve/CVE-2025-62157/\nhttps://www.suse.com/security/cve/CVE-2025-62375/\nhttps://www.suse.com/security/cve/CVE-2025-62506/\nhttps://www.suse.com/security/cve/CVE-2025-62513/\nhttps://www.suse.com/security/cve/CVE-2025-62705/\nhttps://www.suse.com/security/cve/CVE-2025-62714/\nhttps://www.suse.com/security/cve/CVE-2025-62725/\nhttps://www.suse.com/security/cve/CVE-2025-62820/\nhttps://www.suse.com/security/cve/CVE-2025-64101/\nhttps://www.suse.com/security/cve/CVE-2025-64102/\nhttps://www.suse.com/security/cve/CVE-2025-64103/\n","aliases":"CVE-2016-11063\nCVE-2016-11066\nCVE-2016-11067\nCVE-2016-11068\nCVE-2016-11069\nCVE-2016-11070\nCVE-2016-11071\nCVE-2016-11072\nCVE-2016-11073\nCVE-2016-11074\nCVE-2016-11075\nCVE-2016-11076\nCVE-2016-11077\nCVE-2016-11078\nCVE-2016-11079\nCVE-2016-11080\nCVE-2016-11081\nCVE-2016-11082\nCVE-2016-11083\nCVE-2016-11084\nCVE-2017-18872\nCVE-2023-32199\nCVE-2024-58269\nCVE-2025-10545\nCVE-2025-10678\nCVE-2025-10954\nCVE-2025-11374\nCVE-2025-11375\nCVE-2025-11579\nCVE-2025-11621\nCVE-2025-12044\nCVE-2025-26625\nCVE-2025-27093\nCVE-2025-41410\nCVE-2025-41443\nCVE-2025-54286\nCVE-2025-54287\nCVE-2025-54288\nCVE-2025-54289\nCVE-2025-54290\nCVE-2025-54291\nCVE-2025-54293\nCVE-2025-54469\nCVE-2025-54470\nCVE-2025-54471\nCVE-2025-54499\nCVE-2025-58073\nCVE-2025-58075\nCVE-2025-58356\nCVE-2025-59043\nCVE-2025-59048\nCVE-2025-59530\nCVE-2025-59836\nCVE-2025-59937\nCVE-2025-61141\nCVE-2025-61524\nCVE-2025-61581\nCVE-2025-61688\nCVE-2025-62156\nCVE-2025-62157\nCVE-2025-62375\nCVE-2025-62506\nCVE-2025-62513\nCVE-2025-62705\nCVE-2025-62714\nCVE-2025-62725\nCVE-2025-62820\nCVE-2025-64101\nCVE-2025-64102\nCVE-2025-64103\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1a23be4f-881a-3b69-af30-f47e7bd822db","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2ed33f7b-f8d3-3670-bc12-20339a40cad4","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3ff168c0-43f0-3e6a-a46b-90f0b9322304","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6b082ef7-48e6-329d-a108-2122d2ee3fe7","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6df9e33c-98f3-3e85-bd98-4153a1025f74","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"70fcae35-efbf-33bd-b653-2c72a0a85d73","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"73a13c93-e86b-3658-97c0-52e119937024","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"dc8dabed-45c9-3497-b3f5-b41e45657724","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"eb1e91f2-e5cf-3808-8f1f-c394962ed62d","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}