CVE-2025-27933

Description

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

How to fix CVE-2025-27933

To remediate CVE-2025-27933, upgrade the affected package to a fixed version below.

• —upgrade to 10.0.0 or later
• —upgrade to 9.11.9 or later
• —upgrade to 9.11.9+incompatible or later
• —no fix listed
• —no fix listed
• —upgrade to 10.4.3 or later
• —upgrade to 8.0.0-20250218135018-e644e3c8e393 or later

Is CVE-2025-27933 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• >= 9.11.0, < 10.0.0, >= 10.3.0, < 10.5.1
• from 0, < 9.11.9
• >= 9.11.0+incompatible, < 9.11.9+incompatible, >= 10.3.0+incompatible, < 10.3.4+incompatible, >= 10.4.0+incompatible, < 10.4.3+incompatible
• from 0
• from 0
• >= 10.4.0, < 10.4.3
• from 0, < 8.0.0-20250218135018-e644e3c8e393

CVSS scores

References (4)

• ADVISORYgithub.com/advisories/GHSA-h5v9-xw2g-7hrq
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-27933
• PATCHgithub.com/mattermost/mattermost
• WEBmattermost.com/security-updates