CVE-2025-41436: mattermost server before 11.0.0 (exclusive); +1 more affected products

Affected technology

mattermost server · before 11.0.0 (exclusive)
mattermost

Mattermost · <11.0 through <11.0
Mattermost

Description’s affected range: versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Users to view archived channels" setting which allows regular users can access archived channel content and files via the "Open in Channel" functionality from followed threads. Vendor/CNA’s CVSS 3.1 assessment (base score 3.1/10) rates confidentiality impact as low; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality impact as low; integrity and availability impact as none.