| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 10.11.0, < 10.11.4≥ 10.11.0+incompatible, < 10.11.4+incompatible≥ 10.5.0, < 10.5.12≥ 10.5.0+incompatible, < 10.5.12+incompatible | 10.11.410.11.4+incompatible10.5.1210.5.12+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | < 8.0.0-20250905150616-ba86dfc5876b6all versions | 8.0.0-20250905150616-ba86dfc5876b6 |
| mattermost server | ≥ 10.11.0, < 10.11.4≥ 10.5.0, < 10.5.12 | 10.11.410.5.12 |
Mattermost versions 10.11.x <= 10.11.3, and 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free