CVE-2025-11776
published 2025-11-14CVE-2025-11776: Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.19%
8.7th percentile
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost | >= 0 < 5.3.2-0.20250815165020-c8d66301415d | 5.3.2-0.20250815165020-c8d66301415d |
| github.com | mattermost_mattermost-server | >= 0 < 5.3.2-0.20250815165020-c8d66301415d | 5.3.2-0.20250815165020-c8d66301415d |
| github.com | mattermost_mattermost-server_v5 | >= 0 < 5.3.2-0.20250815165020-c8d66301415d | 5.3.2-0.20250815165020-c8d66301415d |
| github.com | mattermost_mattermost-server_v6 | >= 0 < 5.3.2-0.20250815165020-c8d66301415d | 5.3.2-0.20250815165020-c8d66301415d |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20250815165020-c8d66301415d | 8.0.0-20250815165020-c8d66301415d |
| mattermost | mattermost | <= <11 | — |
| mattermost | mattermost_server | < 11.0.0 | 11.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost
osv·2025-11-17
CVE-2025-11776 Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost
Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost
Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mattermost/mattermost/v5 before v5.3.2-0.20250815165020-c8d66301415d; github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20250815165020-c8d66301415d.
OSV
Mattermost fails to properly restrict access to archived channel search API
osv·2025-11-14
CVE-2025-11776 [MEDIUM] Mattermost fails to properly restrict access to archived channel search API
Mattermost fails to properly restrict access to archived channel search API
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GHSA
Mattermost fails to properly restrict access to archived channel search API
ghsa·2025-11-14
CVE-2025-11776 [MEDIUM] CWE-863 Mattermost fails to properly restrict access to archived channel search API
Mattermost fails to properly restrict access to archived channel search API
Mattermost versions < 11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
GHSA
GeoServer Missing Authorization on REST API Index
ghsa·2025-06-10
CVE-2025-27505 [MEDIUM] CWE-862 GeoServer Missing Authorization on REST API Index
GeoServer Missing Authorization on REST API Index
### Summary
It is possible to bypass the default REST API security and access the index page.
### Details
The REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`).
### Impact
The REST API index can disclose whether certain extensions are installed.
### Workaround
In `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer.
### References
https://osgeo-org.atlassian.net/browse/GEOS-11664
https://osgeo-org.atlassian.net/browse/GEOS-11776
https://github.com/geoserver/geoserver/pull/8170
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-14
Published