Detections
Analytics

Mattermost Server < 11.0.0 Multiple Vulnerabilities (MMSA-2024-00337, MMSA-2025-00493, MMSA-2025-00540)

high Nessus Plugin ID 275845

Language:

Synopsis

The remote host is missing a security update.

Description

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2024-00337, MMSA-2025-00493, MMSA-2025-00540 advisory.

 - Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint. (CVE-2025-11776)

 - Mattermost versions <11.0 fail to properly enforce the 'Allow users to view archived channels' setting which allows regular users to access archived channel content and files via the 'Open in Channel' functionality from followed threads. (CVE-2025-41436)

 - Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events. (CVE-2025-55070)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Mattermost Server version 11.0.0 or later.

See Also

https://mattermost.com/security-updates/

Plugin Details

Severity: High

ID: 275845

File Name: mattermost_server_MMSA-2024-00337_00493_00540.nasl

Version: 1.2

Type: remote

Family: CGI abuses

Published: 11/20/2025

Updated: 11/21/2025

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2025-55070

CVSS v3

Risk Factor: High

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vulnerability Information

CPE: cpe:/a:mattermost:mattermost_server

Required KB Items: installed_sw/Mattermost Server

Patch Publication Date: 11/14/2025

Vulnerability Publication Date: 11/14/2025

Reference Information

CVE: CVE-2025-11776, CVE-2025-41436, CVE-2025-55070

IAVA: 2025-A-0866