Listen to this Post
How the CVE Works:
Mattermost fails to enforce proper access controls for guest users in affected versions (10.7.0 and below, 10.5.3 and below, 9.11.12 and below). The vulnerability allows authenticated guest users to access channel member metadata via the API endpoint /api/v4/channels/{channel_id}/members, which should be restricted. Due to improper validation, guest users can retrieve details like user IDs and roles, potentially aiding reconnaissance for further attacks. The flaw stems from missing privilege checks in the channel member listing function, permitting unauthorized data exposure in public channels.
DailyCVE Form:
Platform: Mattermost
Version: 10.7.0, 10.5.3, 9.11.12
Vulnerability: Access Control Bypass
Severity: Low
Date: May 30, 2025
Prediction: Patch expected by June 10, 2025
What Undercode Say:
Analytics:
- Exploit Likelihood: Low (requires guest access)
- Attack Surface: Public channels only
- Impact: Information disclosure
Exploit Command (curl):
curl -X GET -H "Authorization: Bearer GUEST_TOKEN" "https://target.com/api/v4/channels/TARGET_CHANNEL/members"
Mitigation Steps:
- Immediate Workaround: Disable guest access via
System Console > Guest Access.
2. Patch Verification:
Check Mattermost version: curl -s https://target.com/api/v4/system/ping | jq .version
3. Upgrade Command:
For Docker deployments: docker pull mattermost/mattermost-team-edition:10.7.1
Detection Script (Python):
import requests
def check_cve_2025_xxxx(target_url, guest_token):
headers = {"Authorization": f"Bearer {guest_token}"}
try:
r = requests.get(f"{target_url}/api/v4/channels/random/members", headers=headers)
return r.status_code == 200 and "user_id" in r.text
except:
return False
Post-Patch Validation:
-- Database query to verify guest permissions (PostgreSQL): SELECT Roles FROM Users WHERE Username LIKE 'guest%';
Network Protection Rule (iptables):
Block unpatched instances from external access: iptables -A INPUT -p tcp --dport 8065 -m string --string "api/v4/channels" --algo bm -j DROP
Log Monitoring Alert (Splunk):
index=mattermost_logs "GET /api/v4/channels//members" user_role=guest | stats count by src_ip
Expected Patch Indicators:
- Commit hash `c23f44fe8ed0` in v8.0.0
- API response `403 Forbidden` for guest requests post-patch.
No further commentary.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
