Information Exposure Affecting github.com/mattermost/mattermost/server/channels/api4 package, versions >=10.5.0 <10.5.13>=10.11.0 <10.11.5>=10.12.0 <10.12.2>=11.0.0-alpha.1 <11.0.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMATTERMOSTMATTERMOSTSERVERCHANNELSAPI4-14147532
- published28 Nov 2025
- disclosed27 Nov 2025
- credithainguyen0207
Introduced: 27 Nov 2025
NewCVE-2025-12559 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/mattermost/mattermost/server/channels/api4 to version 10.5.13, 10.11.5, 10.12.2, 11.0.3 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure via the GET /api/v4/channels/{channel_id}/common_teams endpoint. An attacker can access team email addresses intended to be visible only to Team Admins by making authenticated requests to this endpoint.