Mattermost Server exposes sensitive user credentials during shared channel membership synchronization

published 2025-09-15 13 mo ago modified 2026-10-19 20 d ago also GHSA-3vcm-c42p-3hhf , GO-2025-3950 , EUVD-2025-29165

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

Patch / fix

fixed in 3 distros 2

go github.com/mattermost/mattermost/server/v8 8.0.0-20250729073403-517ae758cd02
go github.com/mattermost/mattermost-server 10.10.2, 10.10.2+incompatible
Mattermost Mattermost 10.10.2, 10.11.0

suse opensuse

govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250918T182144-150000.1.107.1

suse advisories SUSE-SU-2025:03289-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
govulncheck-vulndb openSUSE Tumbleweed 0.0.20250917T170349-1.1

opensuse advisories openSUSE-SU-2026:21483-1 openSUSE-SU-2025:15564-1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 13 mo ago (2025-09-15)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/mattermost/mattermost/server/v8	<8.0.0-20250729073403-517ae758cd02 all versions	8.0.0-20250729073403-517ae758cd02
go	github.com/mattermost/mattermost-server	>=10.10.0, <10.10.2 >=10.10.0+incompatible, <10.10.2+incompatible	10.10.2 10.10.2+incompatible
go	github.com/mattermost/mattermost-server/v5	all versions	no fix listed
go	github.com/mattermost/mattermost-server/v6	all versions	no fix listed

Affected products

Mattermost Mattermost

Classification

Weakness

CWE-862 Missing Authorization

References

mattermost.com /security-updates
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2025-9076
advisory
github.com /mattermost/mattermost
package
github.com /advisories/GHSA-3vcm-c42p-3hhf
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary