| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost | < 5.3.2-0.20250905150616-ba86dfc5876ball versions | 5.3.2-0.20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost-server | ≥ 10.11.0, < 10.11.4≥ 10.11.0+incompatible, < 10.11.4+incompatible≥ 10.5.0, < 10.5.12≥ 10.5.0+incompatible, < 10.5.12+incompatible< 5.3.2-0.20250905150616-ba86dfc5876b | 10.11.410.11.4+incompatible10.5.1210.5.12+incompatible5.3.2-0.20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost-server/v5 | < 5.3.2-0.20250905150616-ba86dfc5876ball versions | 5.3.2-0.20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost-server/v6 | < 5.3.2-0.20250905150616-ba86dfc5876ball versions | 5.3.2-0.20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250905150616-ba86dfc5876b< 8.0.0-20251212204551-54f2e9b4afd5 | 8.0.0-20250905150616-ba86dfc5876b8.0.0-20251212204551-54f2e9b4afd5 |
| github.com/mattermost/mattermost/v5 | all versions | |
| mattermost server | ≥ 10.11.0, < 10.11.4≥ 10.5.0, < 10.5.12 | 10.11.410.5.12 |
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API, which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free