CVE-2025-27933
published 2025-03-21CVE-2025-27933: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with…
PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.19%
9.5th percentile
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 9.11.9 | 9.11.9 |
| github.com | mattermost_mattermost-server | >= 10.3.0+incompatible < 10.3.4+incompatible | 10.3.4+incompatible |
| github.com | mattermost_mattermost-server | >= 10.4.0+incompatible < 10.4.3+incompatible | 10.4.3+incompatible |
| github.com | mattermost_mattermost-server | >= 9.11.0+incompatible < 9.11.9+incompatible | 9.11.9+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20250218135018-e644e3c8e393 | 8.0.0-20250218135018-e644e3c8e393 |
| github.com | mattermost_mattermost_server_v8 | >= 10.3.0 < 10.3.4 | 10.3.4 |
| github.com | mattermost_mattermost_server_v8 | >= 10.4.0 < 10.4.3 | 10.4.3 |
| github.com | mattermost_mattermost_server_v8 | >= 9.11.0 < 9.11.9 | 9.11.9 |
| mattermost | mattermost | 10.3.0 – 10.3.3 | — |
| mattermost | mattermost | 10.4.0 – 10.4.2 | — |
| mattermost | mattermost | 9.11.0 – 9.11.8 | — |
| mattermost | mattermost_server | >= 10.3.0 < 10.3.4 | 10.3.4 |
| mattermost | mattermost_server | >= 10.4.0 < 10.4.3 | 10.4.3 |
| mattermost | mattermost_server | >= 9.11.0 < 9.11.9 | 9.11.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
osv·2025-03-25
CVE-2025-27933 Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server
OSV
Mattermost allows members with permission to convert public channels to private and convert private to public
osv·2025-03-21
CVE-2025-27933 [MEDIUM] Mattermost allows members with permission to convert public channels to private and convert private to public
Mattermost allows members with permission to convert public channels to private and convert private to public
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.
GHSA
Mattermost allows members with permission to convert public channels to private and convert private to public
ghsa·2025-03-21
CVE-2025-27933 [MEDIUM] CWE-863 Mattermost allows members with permission to convert public channels to private and convert private to public
Mattermost allows members with permission to convert public channels to private and convert private to public
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-21
Published