Mattermost Server CVE-2025-41443

Requires a valid authenticated guest account on the target Mattermost server (PR:L), and the server must be running an affected version (10.5.x ≤ 10.5.12 or 10.11.x ≤ 10.11.2); guest access must be enabled and the attacker must belong to the relevant team. Exploitation is network-reachable against the standard REST API with no user interaction, but is LIMITED to disclosing public-channel identifiers and metadata only - no message content, no write access, and no availability impact. Realistic risk is therefore confined to deployments that provision guest accounts to semi-trusted external parties.

This is a low-to-moderate severity information-disclosure issue, not a high-priority emergency. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects limited impact: confidentiality-only (C:L), with no integrity or availability effect, requiring an authenticated guest account (PR:L). All signals point the same direction and are consistent: EPSS is low at 0.31% (22nd percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data - so no public exploit identified at time of analysis. CWE-862 (Missing Authorization) matches the description, an authorization gap where guest users bypass channel-visibility restrictions. Note a terminology caveat: the input Tags label this 'Authentication Bypass', but the flaw is an authorization/permissions failure affecting already-authenticated guest accounts, not an authentication bypass - this does not change the risk but should be understood correctly. No key signals conflict; the main caveat is that the sole reference is a generic NVD-linked Mattermost security-updates page rather than a specific advisory, so fixed-version details below rely on the NVD description only.

An attacker who has been granted (or has obtained) a guest account on a Mattermost server queries the /api/v4/teams/{team_id}/channels/ids endpoint and receives identifiers and metadata for active public channels they should not be able to discover. This yields reconnaissance value - channel names and structure revealing teams, projects, or topics - rather than message content. No public proof-of-concept was provided, and exploitation requires valid guest credentials (AC:L, PR:L).