CVE-2025-27571
📋 TL;DR
This vulnerability allows authenticated users to view metadata from archived channels even when the 'Allow Users to View Archived Channels' setting is disabled. It affects Mattermost instances running vulnerable versions, potentially exposing sensitive channel information that should remain hidden.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Sensitive archived channel metadata (including post content previews, participant lists, timestamps) could be exposed to unauthorized authenticated users, potentially revealing confidential discussions or project information.
Likely Case
Authenticated users can access metadata about archived channels they shouldn't have permission to view, potentially learning about past discussions, participants, or project details.
If Mitigated
With proper access controls and monitoring, impact is limited to metadata exposure rather than full channel access, and can be detected through audit logging.
🎯 Exploit Status
Exploitation involves accessing posts from archived channels through normal API calls or UI interactions that bypass the configuration check.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions 10.5.2, 10.4.4, 9.11.10 and later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance and database. 2. Download the patched version from Mattermost releases. 3. Stop the Mattermost service. 4. Replace the installation with the patched version. 5. Restart the Mattermost service. 6. Verify the version is updated.
🔧 Temporary Workarounds
Disable archived channel access
allTemporarily disable all archived channel functionality until patching can be completed
# Configure Mattermost to disable archived channels
# Edit config.json or use System Console:
# System Console > Site Configuration > Users and Teams > Allow Users to View Archived Channels = false
Restrict user permissions
allTighten user permissions and implement principle of least privilege
# Review and restrict user roles and permissions
# System Console > User Management > Permissions
# Consider removing unnecessary permissions from standard user roles
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual access to archived channels
- Disable archived channel functionality entirely through configuration changes
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About Mattermost or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Verify version is 10.5.2+, 10.4.4+, or 9.11.10+ and test that archived channel metadata is properly restricted when 'Allow Users to View Archived Channels' is disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to archived channels
- API requests for archived channel metadata from unauthorized users
- Failed permission checks for archived channel access
Network Indicators:
- Increased API calls to channel endpoints with archived=true parameter
- Requests for posts from archived channels
SIEM Query:
source="mattermost" AND ("archived" OR "channel_metadata") AND user_id NOT IN [authorized_users]