CVE-2025-11777 — Cross-team channel membership access
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to…
Published: 2025-11-13 · CVSS: 3.1 · CVSS 3.1
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7