Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549 [CVSS 3.1 LOW]
Race Condition
Mattermost Server
NVD
CVSS 3.1
3.1
EPSS
0.0%
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface.
Information Disclosure
Cors Misconfiguration
NVD
CVSS 4.0
2.0
EPSS
0.0%