Overview
CVE-2025-11777 is a low-severity information disclosure vulnerability affecting specific versions of Mattermost. This vulnerability allows users from one team to potentially access user metadata and channel membership information from other teams through the Add Channel Member API due to improper team membership permission validation.
Technical Details
The vulnerability resides in the Add Channel Member API endpoint within Mattermost. Versions 10.11.x (<= 10.11.3) and 10.5.x (<= 10.5.11) fail to adequately validate whether a user attempting to add a member to a channel has the necessary permissions to access information about users and channels from other teams. This flawed permission check allows a user from one team to leverage the API to retrieve sensitive data, such as usernames, roles, and channel memberships, from other teams within the Mattermost instance. An attacker could potentially enumerate users and channels outside their designated team, leading to a privacy breach.
CVSS Analysis
- CVE ID: CVE-2025-11777
- Severity: LOW
- CVSS Score: 3.1
The low CVSS score is attributed to the requirement of being an authenticated user to exploit the vulnerability and the limited scope of the impact. While the vulnerability allows for information disclosure, it does not directly lead to code execution or system compromise.
Possible Impact
Although classified as low severity, the exploitation of CVE-2025-11777 can have the following potential impacts:
- Information Disclosure: Exposure of user metadata (e.g., usernames, roles) across teams.
- Channel Membership Leakage: Revealing which users are members of specific channels in other teams.
- Potential for Social Engineering: Information gathered could be used for targeted social engineering attacks.
- Privacy Violations: Unauthorized access to information intended for specific teams.
Mitigation and Patch Steps
To address this vulnerability, it is highly recommended to upgrade your Mattermost instance to a patched version. Specifically:
- Upgrade to a version greater than 10.11.3 if you are using the 10.11.x branch.
- Upgrade to a version greater than 10.5.11 if you are using the 10.5.x branch.
Refer to the official Mattermost security updates page for the latest patched versions and instructions:
