What’s Vulnerable › Vulnerabilities

CVE-2025-14350: Information disclosure via channel mentions in posts

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-16 · updated 2026-06-17
• Weakness: CWE-862

Description

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563

Affected products

• Mattermost: from 10.11.0 before 10.11.10; from 11.1.0 before 11.1.3; from 11.2.0 before 11.2.2 — fixed in 10.11.10, 11.1.3, 11.2.2

How to fix

Upgrade to a fixed version: Mattermost 10.11.10, 11.1.3, 11.2.2. Check the vendor advisory for mitigations.

References

• https://mattermost.com/security-updates

Get alerted when CVE-2025-14350 or the next vulnerability affects your stack