CVE-2025-11776: Mattermost Server

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint

Affected products

• Mattermost Mattermost Server: before 11.0.0 (fixed in 11.0.0)

Published 2025-11-14. Last modified 2026-06-17.