CVE-2025-41443 — Guest user can discover active public channels
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discove…
Published: 2025-10-16 · CVSS: 4.3 · CVSS 3.1
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7