CVE-2025-11777

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11777", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-10-15T11:37:25.782Z", "datePublished": "2025-11-13T17:32:03.975Z", "dateUpdated": "2025-11-13T18:01:46.459Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.11.3", "status": "affected", "version": "10.11.0", "versionType": "semver"}, {"lessThanOrEqual": "10.5.11", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"version": "11.0.0", "status": "unaffected"}, {"version": "10.11.4", "status": "unaffected"}, {"version": "10.5.12", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Xiangyu Guo"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW", "baseScore": 3.1}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-863: Incorrect Authorization", "cweId": "CWE-863"}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"value": "Update Mattermost to versions 11.0.0, 10.11.4, 10.5.12 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2025-00518", "defect": ["https://mattermost.atlassian.net/browse/MM-64661"], "discovery": "EXTERNAL"}, "title": "Cross-team channel membership access", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-11-13T17:32:03.975Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T18:01:38.258075Z", "id": "CVE-2025-11777", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T18:01:46.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11777", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T18:01:38.258075Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T18:01:42.725Z"}}], "cna": {"title": "Cross-team channel membership access", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-64661"], "advisory": "MMSA-2025-00518", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Xiangyu Guo"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.3"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.11"}, {"status": "unaffected", "version": "11.0.0"}, {"status": "unaffected", "version": "10.11.4"}, {"status": "unaffected", "version": "10.5.12"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 11.0.0, 10.11.4, 10.5.12 or higher."}], "references": [{"url": "https://mattermost.com/security-updates"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-11-13T17:32:03.975Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11777", "state": "PUBLISHED", "dateUpdated": "2025-11-13T18:01:46.459Z", "dateReserved": "2025-10-15T11:37:25.782Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-11-13T17:32:03.975Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.11.3", "status": "affected", "version": "10.11.0", "versionType": "semver"}, {"lessThanOrEqual": "10.5.11", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "11.0.0"}, {"status": "unaffected", "version": "10.11.4"}, {"status": "unaffected", "version": "10.5.12"}]}], "source": "responsibledisclosure@mattermost.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCE1652A-13F7-4934-9F90-28129BAEE240", "versionEndExcluding": "10.5.12", "versionStartIncluding": "10.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A1F41DC-D93D-48A7-8A3B-623C3344E979", "versionEndExcluding": "10.11.4", "versionStartIncluding": "10.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint"}, {"lang": "es", "value": "Las versiones de Mattermost 10.11.x menor o igual que 10.11.3, 10.5.x menor o igual que 10.5.11 no validan correctamente los permisos de membres\u00eda de equipo en la API Add Channel Member, lo que permite a usuarios de un equipo acceder a metadatos de usuario e informaci\u00f3n de membres\u00eda de canal de otros equipos a trav\u00e9s del endpoint de la API."}], "id": "CVE-2025-11777", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11777", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-13T18:01:38.258075Z", "version": "2.0.3"}}]}, "published": "2025-11-13T18:15:49.393", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}

{"created": "2025-11-14T09:28:15.348196+00:00", "updated": "2025-11-14T09:28:15.348233+00:00", "vendors": ["mattermost", "mattermost$PRODUCT$mattermost"]}