CVE-2025-11777 — Cross-team channel membership access

CVE-2025-11777

Cross-team channel membership access PUBLISHED

Description (CNA)

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.11.0 through 10.11.3; affected 10.5.0 through 10.5.11; unaffected 11.0.0; unaffected 10.11.4; unaffected 10.5.12

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.