CVE-2025-27571: Channel metadata visible in archived channels despite configuration setting
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27571?
CVE-2025-27571 has been rated as a medium severity vulnerability due to its impact on data exposure in archived channels.
How do I fix CVE-2025-27571?
To fix CVE-2025-27571, upgrade Mattermost to version 10.5.2 or later, 10.4.4 or later, or 9.11.10 or later.
What versions of Mattermost are affected by CVE-2025-27571?
CVE-2025-27571 affects Mattermost versions 10.5.x up to and including 10.5.1, 10.4.x up to and including 10.4.3, and 9.11.x up to and including 9.11.9.
What types of users are affected by CVE-2025-27571?
Authenticated users on affected Mattermost versions can access the metadata of archived channels, breaching the intended access restrictions.
Is there a workaround for CVE-2025-27571?
Though upgrading is recommended, a temporary workaround is to disable the viewing of archived channels in the Mattermost settings until patched.