CVE-2025-11776 — Guest user can discover archived public channels
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{tea…
Published: 2025-11-14 · CVSS: 4.3 · CVSS 3.1
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7