CVE-2025-27933

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

Published: Mar 21, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-27933
GHSA: GHSA-h5v9-xw2g-7hrq
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	10.4.0	10.4.3
github.com/mattermost/mattermost/server/v8	10.3.0	10.3.4
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.9
github.com/mattermost/mattermost-server	-	9.11.9
github.com/mattermost/mattermost/server/v8	-	8.0.0-20250218135018-e644e3c8e393
mattermost / mattermost_server	10.3.0	10.3.4
mattermost / mattermost_server	10.4.0	10.4.3
mattermost / mattermost_server	9.11.0	9.11.9

https://mattermost.com/security-updates

Vulnerability Database

CVE-2025-27933

Deep Security Visibility Without the Complexity