Guest user can add unauthorized team users to private channels

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-10545 · Microsoft / collected KEV context

EUVD-2025-34728

GHSA-424h-xj87-m937

GO-2025-4030

cve-program · CVE-2025-10545

• https://mattermost.com/security-updates

euvd · EUVD-2025-34728

• https://mattermost.com/security-updates

nvd · CVE-2025-10545

• https://mattermost.com/security-updates

osv · GHSA-424h-xj87-m937

• https://nvd.nist.gov/vuln/detail/CVE-2025-10545
• https://github.com/mattermost/mattermost/pull/31319
• https://github.com/mattermost/mattermost/pull/33827
• https://github.com/mattermost/mattermost/commit/fb9c583f5e466a566a5122154ef337bbf2238902
• https://github.com/mattermost/mattermost/commit/ff30b84049f0193f0570d30e46cffc3602298c67
• https://github.com/mattermost/mattermost
• https://mattermost.com/security-updates

osv · GO-2025-4030

• https://github.com/advisories/GHSA-424h-xj87-m937
• https://nvd.nist.gov/vuln/detail/CVE-2025-10545
• https://github.com/mattermost/mattermost/commit/fb9c583f5e466a566a5122154ef337bbf2238902
• https://github.com/mattermost/mattermost/commit/ff30b84049f0193f0570d30e46cffc3602298c67
• https://github.com/mattermost/mattermost/pull/31319
• https://github.com/mattermost/mattermost/pull/33827
• https://mattermost.com/security-updates

No related operational record is retained in the current change model.