FlawAtlas
Search the atlas
CVE-2025-2564 Moderate

Unauthorized View Access to Archived Channel Member Info

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.

Exploit probability 0.3%
Published April 16, 2025
Required by Not available
Last source change August 12, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

45 explicit affected versions

Go github.com/mattermost/mattermost/server/v8
Go github.com/mattermost/mattermost-server
Go github.com/mattermost/mattermost-server/v5
Go github.com/mattermost/mattermost-server/v6
Go github.com/mattermost/mattermost/server/v8

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-2564

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.

View original source
Open Source Vulnerabilities GO-2025-3623

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

View original source
Open Source Vulnerabilities GHSA-mj2p-v2c2-vh4v

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled.

View original source

05 / REFERENCES

Further evidence