cbcvebase.
CVE-2025-27933
published 2025-03-21

CVE-2025-27933: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with…

PriorityP420medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.19%
9.5th percentile
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

Affected

14 ranges
VendorProductVersion rangeFixed in
github.commattermost_mattermost-server>= 0 < 9.11.99.11.9
github.commattermost_mattermost-server>= 10.3.0+incompatible < 10.3.4+incompatible10.3.4+incompatible
github.commattermost_mattermost-server>= 10.4.0+incompatible < 10.4.3+incompatible10.4.3+incompatible
github.commattermost_mattermost-server>= 9.11.0+incompatible < 9.11.9+incompatible9.11.9+incompatible
github.commattermost_mattermost_server_v8>= 0 < 8.0.0-20250218135018-e644e3c8e3938.0.0-20250218135018-e644e3c8e393
github.commattermost_mattermost_server_v8>= 10.3.0 < 10.3.410.3.4
github.commattermost_mattermost_server_v8>= 10.4.0 < 10.4.310.4.3
github.commattermost_mattermost_server_v8>= 9.11.0 < 9.11.99.11.9
mattermostmattermost10.3.0 – 10.3.3
mattermostmattermost10.4.0 – 10.4.2
mattermostmattermost9.11.0 – 9.11.8
mattermostmattermost_server>= 10.3.0 < 10.3.410.3.4
mattermostmattermost_server>= 10.4.0 < 10.4.310.4.3
mattermostmattermost_server>= 9.11.0 < 9.11.99.11.9
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.