Skip to content

x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-qwwm-c582-82rx #3772

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-qwwm-c582-82rx#3772
Assignees
markus-kusano
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Jun 20, 2025

Advisory GHSA-qwwm-c582-82rx references a vulnerability in the following Go modules:

Module
github.com/mattermost/mattermost-server
github.com/mattermost/mattermost-server/v5
github.com/mattermost/mattermost-server/v6
github.com/mattermost/mattermost/server/v8

Description:
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - fixed: 0.0.0-20250520060012-d0380305ef7a
      non_go_versions:
        - introduced: TODO (earliest fixed "10.6.6", vuln range ">= 10.6.0, <= 10.6.5")
        - introduced: TODO (earliest fixed "10.7.3", vuln range ">= 10.7.0, <= 10.7.2")
        - introduced: TODO (earliest fixed "10.8.1", vuln range "= 10.8.0")
        - introduced: TODO (earliest fixed "9.11.16", vuln range ">= 9.11.0, <= 9.11.15")
        - introduced: TODO (earliest fixed "10.5.6", vuln range ">= 10.5.0, <= 10.5.5")
    - module: github.com/mattermost/mattermost-server/v5
      vulnerable_at: 5.39.3
    - module: github.com/mattermost/mattermost-server/v6
      vulnerable_at: 6.7.2
    - module: github.com/mattermost/mattermost/server/v8
      versions:
        - fixed: 8.0.0-20250520060012-d0380305ef7a
summary: Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-3227
ghsas:
    - GHSA-qwwm-c582-82rx
references:
    - advisory: https://github.com/advisories/GHSA-qwwm-c582-82rx
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-3227
    - web: https://mattermost.com/security-updates
notes:
    - fix: 'module merge error: could not merge versions of module github.com/mattermost/mattermost-server: invalid or non-canonical semver version (found TODO (earliest fixed "10.6.6", vuln range ">= 10.6.0, <= 10.6.5"))'
    - fix: 'github.com/mattermost/mattermost/server/v8: could not add vulnerable_at: could not find tagged version between introduced and fixed'
    - fix: 'github.com/mattermost/mattermost-server: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-qwwm-c582-82rx
    created: 2025-06-20T19:02:17.299275704Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

Labels

triaged

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions