CVE-2025-41436: Mattermost Server

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads

Affected products

• Mattermost Mattermost Server: before 11.0.0 (fixed in 11.0.0)

Published 2025-11-14. Last modified 2026-06-17.