| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 9.11.0+incompatible, < 9.11.9+incompatible | 9.11.9+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | ≥ 9.11.0, < 9.11.9< 8.0.0-20250204211032-f52e08754c49all versions | 9.11.98.0.0-20250204211032-f52e08754c49 |
| mattermost server | ≥ 9.11.0, < 9.11.9 | 9.11.9 |
Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free