CVE-2025-9076: Mattermost Server exposes sensitive user credentials during shared channel membership synchronization
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9076?
CVE-2025-9076 is considered a high severity vulnerability due to its potential to expose sensitive user information.
How does CVE-2025-9076 affect Mattermost?
CVE-2025-9076 affects Mattermost versions 10.10.x up to and including 10.10.1 by failing to properly sanitize user data during shared channel membership synchronization.
How do I fix CVE-2025-9076?
To fix CVE-2025-9076, upgrade Mattermost to version 10.10.2 or later, where the vulnerability has been addressed.
What types of information can be accessed through CVE-2025-9076?
CVE-2025-9076 can allow malicious or compromised remote clusters to access sensitive user information via unsanitized user objects.
Is there a patch available for CVE-2025-9076?
Yes, patches for CVE-2025-9076 are included in Mattermost version 10.10.2 and later.