CVE-2025-1792
Improper Access Control in Mattermost Channel Member API
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Access Control in Mattermost Channel Member API
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Record
CVE-2025-1792- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2025-16489
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Record
EUVD-2025-16489- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hc6v-386m-93pq
Mattermost fails to properly enforce access controls for guest users
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Record
GHSA-hc6v-386m-93pq- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Record
CVE-2025-1792- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Improper Access Control in Mattermost Channel Member API
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Record
CVE-2025-1792- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-hc6v-386m-93pq
Mattermost fails to properly enforce access controls for guest users
Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.
- Record
GHSA-hc6v-386m-93pq- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGO-2025-3730 No score
Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server
Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server
- Record
GO-2025-3730- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15225-1 No score
govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15225-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go |
10.6.0-rc1 up to 10.7.1 | 10.7.1 |
github.com/mattermost/mattermost/server/v8Go |
10.0.0-rc1 up to 10.5.4 | 10.5.4 |
github.com/mattermost/mattermost/server/v8Go |
9.0.0-rc1 up to 9.11.13 | 9.11.13 |
github.com/mattermost/mattermost/server/v8Go |
before 8.0.0-20250414110750-c23f44fe8ed0 | 8.0.0-20250414110750-c23f44fe8ed0 |
github.com/mattermost/mattermost-serverGo |
9.0.0-rc1+incompatible up to 9.11.13+incompatible, 10.0.0-rc1+incompatible up to 10.5.4+incompatible, 10.6.0-rc1+incompatible up to 10.7.1+incompatible | 9.11.13+incompatible10.5.4+incompatible10.7.1+incompatible |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 29 CVEs |
before 0.0.20250612T141001-1.1 | 0.0.20250612T141001-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-1792 is a low vulnerability (CVSS 3.1) in Mattermost, published May 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in github.com/mattermost/mattermost/server/v8 10.7.1.
References
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-1792
github.com/mattermost/mattermost/commit/c23f44fe8ed02f71d506f99adc30ad34c58c89d1
Show 29 moreShow less
suse.com/security/cve/CVE-2020-36846