---
id: CVE-2025-1792
aliases:
  - GHSA-hc6v-386m-93pq
  - GO-2025-3730
title: Mattermost fails to properly enforce access controls for guest users
summary: Mattermost fails to properly enforce access controls for guest users
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
vendor: mattermost
product: github.com/mattermost/mattermost/server/v8
ecosystem: go
affected:
  - 'github.com/mattermost/mattermost/server/v8 >= 10.6.0-rc1, < 10.7.1'
  - 'github.com/mattermost/mattermost/server/v8 >= 10.0.0-rc1, < 10.5.4'
  - 'github.com/mattermost/mattermost/server/v8 >= 9.0.0-rc1, < 9.11.13'
  - >-
    github.com/mattermost/mattermost/server/v8 <
    8.0.0-20250414110750-c23f44fe8ed0
patched:
  - github.com/mattermost/mattermost/server/v8 10.7.1
  - github.com/mattermost/mattermost/server/v8 10.5.4
  - github.com/mattermost/mattermost/server/v8 9.11.13
  - github.com/mattermost/mattermost/server/v8 8.0.0-20250414110750-c23f44fe8ed0
published: '2025-05-30'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hc6v-386m-93pq'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-1792'
  - url: >-
      https://github.com/mattermost/mattermost/commit/c23f44fe8ed02f71d506f99adc30ad34c58c89d1
  - url: 'https://github.com/mattermost/mattermost'
  - url: 'https://mattermost.com/security-updates'
tags:
  - osv
  - go
epss: 0.00241
epssPercentile: 0.15498
ingestedAt: '2026-08-07T19:14:17.142Z'
---

## Overview

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

## Affected packages

- `github.com/mattermost/mattermost/server/v8 >= 10.6.0-rc1, < 10.7.1`
- `github.com/mattermost/mattermost/server/v8 >= 10.0.0-rc1, < 10.5.4`
- `github.com/mattermost/mattermost/server/v8 >= 9.0.0-rc1, < 9.11.13`
- `github.com/mattermost/mattermost/server/v8 < 8.0.0-20250414110750-c23f44fe8ed0`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost/server/v8 10.7.1`
- `github.com/mattermost/mattermost/server/v8 10.5.4`
- `github.com/mattermost/mattermost/server/v8 9.11.13`
- `github.com/mattermost/mattermost/server/v8 8.0.0-20250414110750-c23f44fe8ed0`