CVE-2025-11776: GO-2025-4126 - Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost

CVE-2025-11776 · Severity: medium · CVSS 4.3 · Published 2025-11-14

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

Technologies: github.com/mattermost/mattermost (Go), github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2025-11776 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-11776 being exploited in the wild.
How severe is CVE-2025-11776?
Medium severity, with a CVSS score of 4.3, published 14 November 2025.
Which products and versions are affected?
github.com/mattermost/mattermost (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d; github.com/mattermost/mattermost-server (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d; and 2 more.
Is there a fix for CVE-2025-11776?
Yes. github.com/mattermost/mattermost (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later; github.com/mattermost/mattermost-server (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later; github.com/mattermost/mattermost-server/v5 (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later; github.com/mattermost/mattermost-server/v6 (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20250815165020-c8d66301415d or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-11776?
Check whether you run github.com/mattermost/mattermost (Go), github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
    go get github.com/mattermost/mattermost@v5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost-server (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
    go get github.com/mattermost/mattermost-server@v5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost-server/v5 (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
    go get github.com/mattermost/mattermost-server/v5@v5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost-server/v6 (Go): upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
    go get github.com/mattermost/mattermost-server/v6@v5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20250815165020-c8d66301415d or later
    go get github.com/mattermost/mattermost/server/v8@v8.0.0-20250815165020-c8d66301415d

Affected products

  • github.com/mattermost/mattermost (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost-server (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=5.3.2-0.20250815165020-c8d66301415d
  • github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=0,fixed=8.0.0-20250815165020-c8d66301415d
  • github.com/mattermost/mattermost/v5 (Go) SEMVER:introduced=0
  • Mattermost Server

Identifiers

  • CVE-2025-11776
  • GHSA-j6gg-r5jc-47cm
  • GO-2025-4126

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.