CVE-2025-27571

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-275724.1Exposure of sensitive information during transient execution for some TDX within Ring 0: Hypervisor may allow an information disclosure. Aut CVE-2025-275743.6Cross-site scripting vulnerability exists in the USB storage file-sharing function of HGW-BL1500HM Ver 002.002.003 and earlier. If this vuln CVE-2025-275755.3An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID.CVE-2025-275762.9Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow CVE-2025-275777.0in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-275787.5Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory c CVE-2025-275795.4In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bit CVE-2025-275807.5NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, ti CVE-2025-275814.3NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET mo CVE-2025-275827.6The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flaw CVE-2025-275839.1Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Informati CVE-2025-275845.4A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al