CVE-2025-9076 json
Mattermost Server exposes sensitive user credentials during shared channel membership synchronization
published last yr. modified 21d ago also GHSA-3vcm-c42p-3hhf , GO-2025-3950 , EUVD-2025-29165
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.
Patch / fix
- go github.com/mattermost/mattermost/server/v8 8.0.0-20250729073403-517ae758cd02
- go github.com/mattermost/mattermost-server 10.10.2, 10.10.2+incompatible
- Mattermost Mattermost 10.10.2, 10.11.0
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250918T182144-150000.1.107.1
suse advisories SUSE-SU-2025:03289-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250917T170349-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2025:15564-1
Is CVE-2025-9076 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20250729073403-517ae758cd02 all versions |
8.0.0-20250729073403-517ae758cd02 |
| go | github.com/mattermost/mattermost-server | >=10.10.0, <10.10.2 >=10.10.0+incompatible, <10.10.2+incompatible |
10.10.2 10.10.2+incompatible |
| go | github.com/mattermost/mattermost-server/v5 | all versions |
no fix listed |
| go | github.com/mattermost/mattermost-server/v6 | all versions |
no fix listed |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
mattermost.com
/security-updates
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-9076
advisory
-
github.com
/mattermost/mattermost
package
-
github.com
/advisories/GHSA-3vcm-c42p-3hhf
advisory
Sources
- CVE List CVE-2025-9076
- GitHub Advisory GHSA-3vcm-c42p-3hhf
- NVD CVE-2025-9076
- OSV GO-2025-3950
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.