CVE-2025-47871 json
Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API
published last yr. modified 4mo ago also GHSA-wgvp-jj4w-88hf , GO-2025-3797 , EUVD-2025-19558
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint.
Patch / fix
- go github.com/mattermost/mattermost-server 0.0.0-20250513065225-4ae5d647fb88, 9.11.16+incompatible, 10.5.6+incompatible, 10.6.6+incompatible, 10.7.3+incompatible, 10.8.1+incompatible
- go github.com/mattermost/mattermost/server/v8 8.0.0-20250513065225-4ae5d647fb88, 9.11.16, 10.5.6, 10.6.6, 10.7.3, 10.8.1
- Mattermost Mattermost 9.11.16, 10.5.6, 10.6.6, 10.7.3, 10.8.1, 10.9.0
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250730T213748-1.1
opensuse advisories openSUSE-SU-2025:15405-1
Is CVE-2025-47871 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | <0.0.0-20250513065225-4ae5d647fb88 >=9.11.0+incompatible, <9.11.16+incompatible >=10.5.0+incompatible, <10.5.6+incompatible >=10.6.0+incompatible, <10.6.6+incompatible >=10.7.0+incompatible, <10.7.3+incompatible >=10.8.0+incompatible, <10.8.1+incompatible |
0.0.0-20250513065225-4ae5d647fb88 9.11.16+incompatible 10.5.6+incompatible 10.6.6+incompatible 10.7.3+incompatible 10.8.1+incompatible |
| go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250513065225-4ae5d647fb88 >=9.11.0, <9.11.16 >=10.5.0, <10.5.6 >=10.6.0, <10.6.6 >=10.7.0, <10.7.3 >=10.8.0, <10.8.1 |
8.0.0-20250513065225-4ae5d647fb88 9.11.16 10.5.6 10.6.6 10.7.3 10.8.1 |
| go | github.com/mattermost/mattermost-server/v5 | all versions |
no fix listed |
| go | github.com/mattermost/mattermost-server/v6 | all versions |
no fix listed |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
mattermost.com
/security-updates
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-47871
advisory
-
github.com
/mattermost/mattermost
package
-
github.com
/advisories/GHSA-wgvp-jj4w-88hf
advisory
Sources
- CVE List CVE-2025-47871
- GitHub Advisory GHSA-wgvp-jj4w-88hf
- NVD CVE-2025-47871
- OSV GO-2025-3797
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.