CVE-2025-11776

Guest user can discover archived public channels PUBLISHED

Description (CNA)

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected <11 through <11; unaffected 11.0.0

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.