CVE-2025-27933
📋 TL;DR
Mattermost fails to enforce channel conversion restrictions, allowing users with permission to convert public channels to private to also convert private channels to public. This affects Mattermost instances running vulnerable versions, potentially exposing sensitive private channel content.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information from private channels becomes publicly accessible, leading to data breaches, compliance violations, and reputational damage.
Likely Case
Accidental or intentional exposure of private channel discussions to unauthorized users within the organization.
If Mitigated
Limited impact with proper access controls and monitoring, though still a privilege escalation vulnerability.
🎯 Exploit Status
Exploitation requires authenticated user with channel conversion permissions, making it straightforward for authorized users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.4.3, 10.3.4, 9.11.9
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Upgrade to patched version (10.4.3, 10.3.4, or 9.11.9). 3. Restart Mattermost service. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Channel Conversion Permissions
allTemporarily remove or restrict permissions for users to convert channels until patching.
Use Mattermost System Console > Permissions to modify channel conversion settings
🧯 If You Can't Patch
- Audit and restrict user permissions for channel conversions to trusted administrators only
- Implement enhanced monitoring for channel permission changes and audit logs
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About Mattermost or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Confirm version is 10.4.3, 10.3.4, 9.11.9 or higher, then test channel conversion restrictions📡 Detection & Monitoring
Log Indicators:
- Channel conversion events in Mattermost audit logs
- Unexpected channel permission changes
Network Indicators:
- API calls to channel conversion endpoints
SIEM Query:
source="mattermost" AND (event="channel_converted" OR event="permission_changed")