CVE-2025-11777
Cross-team channel membership access
Reported by mattermost · Published November 13, 2025
github.com/mattermost/mattermost-server/v5 is fixed in 5.3.2-0.20250905150616-ba86dfc5876b (Go Modules)
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/mattermost/mattermost-server/v5 | Go Modules | 5.3.2-0.20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost-server | Go Modules | 10.11.4, 10.5.12, 5.3.2-0.20250905150616-ba86dfc5876b |
| github.com/mattermost/mattermost/server/v8 | Go Modules | 8.0.0-20251212204551-54f2e9b4afd5, 8.0.0-20250905150616-ba86dfc5876b |
| mattermost_server | mattermost | 10.11.4, 10.5.12 |
| Mattermost | Mattermost | 10.5.11 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 10.11.0, 10.5.0, 11.0.0 |
| Mattermost | Mattermost | 10.11.0, 10.5.0, 11.0.0 |
Timeline
- Oct 15, 2025 CVE Published
- Nov 13, 2025 Coalition ESS Score (8 in total, the first dated here)
- Nov 13, 2025 PoC Published
- Nov 14, 2025 EPSS Score (30 in total, the first dated here)
- Nov 27, 2025 CVE Updated
- Mar 20, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-11777
vulnetix vdb fixes CVE-2025-11777Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-11777/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart