CVE-2025-24920
📋 TL;DR
Mattermost fails to restrict bookmark creation and updates in archived channels, allowing authenticated users to create or modify bookmarks in channels that should be read-only. This affects Mattermost instances running vulnerable versions, requiring authenticated user access.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Malicious authenticated users could manipulate bookmarks in archived channels to disrupt organization, hide important information, or create misleading references that persist when channels are restored.
Likely Case
Accidental or intentional bookmark modifications in archived channels, causing minor data integrity issues or confusion when archived channels are referenced.
If Mitigated
Limited impact with proper access controls and monitoring, as it only affects bookmarks in archived channels and requires authentication.
🎯 Exploit Status
Exploitation requires authenticated access; simple API calls could manipulate bookmarks in archived channels.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Mattermost 10.4.3, 10.3.4, 9.11.9, or 10.5.1
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Download the patched version from Mattermost releases. 3. Follow Mattermost upgrade documentation for your deployment method. 4. Restart the Mattermost service.
🔧 Temporary Workarounds
Restrict user permissions
allLimit which users can create or modify bookmarks globally to reduce attack surface.
Configure via Mattermost System Console > Permissions
🧯 If You Can't Patch
- Monitor archived channel activity for unexpected bookmark changes
- Implement strict access controls and audit logging for authenticated users
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About Mattermost or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
After patching, verify version is 10.4.3+, 10.3.4+, 9.11.9+, or 10.5.1+ and test that bookmarks cannot be created/modified in archived channels.📡 Detection & Monitoring
Log Indicators:
- Audit log entries showing bookmark creation/updates in archived channels
- Unexpected API calls to bookmark endpoints with archived channel IDs
Network Indicators:
- API requests to /api/v4/channels/{channel_id}/bookmarks where channel_id belongs to archived channel
SIEM Query:
source="mattermost" AND ("bookmark" AND "archived")