CVE-2025-11776

Description

Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/mattermost/mattermost/v5 before v5.3.2-0.20250815165020-c8d66301415d; github.com/mattermost/mattermost-server/v5 before v5.3.2-0.20250815165020-c8d66301415d.

How to fix CVE-2025-11776

To remediate CVE-2025-11776, upgrade the affected package to a fixed version below.

• —no fix listed
• —upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
• —no fix listed
• —upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
• —upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
• —no fix listed
• —no fix listed
• —upgrade to 5.3.2-0.20250815165020-c8d66301415d or later
• —upgrade to 8.0.0-20250815165020-c8d66301415d or later
• —upgrade to 8.0.0-20250815165020-c8d66301415d or later
• —no fix listed

Is CVE-2025-11776 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (11)

• from 0
• from 0, < 5.3.2-0.20250815165020-c8d66301415d
• from 0
• from 0, < 5.3.2-0.20250815165020-c8d66301415d
• from 0, < 5.3.2-0.20250815165020-c8d66301415d
• from 0
• from 0
• from 0, < 5.3.2-0.20250815165020-c8d66301415d
• from 0, < 8.0.0-20250815165020-c8d66301415d

CVSS scores

References (5)

• ADVISORYgithub.com/advisories/GHSA-j6gg-r5jc-47cm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-11776
• PATCHgithub.com/mattermost/mattermost
• WEBgithub.com/mattermost/mattermost/commit/c8d66301415d5b447df0e829bdbaa92e8a83ecf8
• WEB