tocsin

Go/github.com/mattermost/mattermost-server CVE-2025-3227: medium 4.3, EPSS 0.25%

Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 0.0.0-20250520060012-d0380305ef7a or later.

go get github.com/mattermost/mattermost-server@v0.0.0-20250520060012-d0380305ef7a
go get github.com/mattermost/mattermost-server@v9.11.16+incompatible
go get github.com/mattermost/mattermost-server@v10.5.6+incompatible
go get github.com/mattermost/mattermost-server@v10.6.6+incompatible
go get github.com/mattermost/mattermost-server@v10.7.3+incompatible
go get github.com/mattermost/mattermost-server@v10.8.1+incompatible

Affected

introducedfixedlast affected
09.11.16+incompatible-
10.5.0+incompatible10.5.6+incompatible-
10.6.0+incompatible10.6.6+incompatible-
10.7.0+incompatible10.7.3+incompatible-
10.8.0+incompatible10.8.1+incompatible-

Fixed versions

0.0.0-20250520060012-d0380305ef7a9.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible

Sources

CVE-2025-3227 · published · modified · JSON