Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0265

NIXPKGS-2026-0265
published on 17 Feb 2026
Permalink CVE-2026-20796
updated 4 days, 1 hour ago by @LeSuisse Activity log
  • Created automatic suggestion 1 week ago
  • @LeSuisse removed
    4 packages
    • mattermost-desktop
    • python312Packages.mattermostdriver
    • python313Packages.mattermostdriver
    • python314Packages.mattermostdriver
    6 days, 8 hours ago
  • @LeSuisse removed
    5 maintainers
    • @fsagbuya
    • @Kranzes
    • @numinit
    • @mgdelacroix
    • @ryantm
    4 days, 1 hour ago
  • @LeSuisse accepted 4 days, 1 hour ago
  • @LeSuisse published on GitHub 4 days, 1 hour ago
Time-of-check time-of-use vulnerability in common teams API

Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549

Affected products

Mattermost
  • =<10.11.9
  • ==11.3.0
  • ==10.11.10

Matching in nixpkgs

Package maintainers

Ignored maintainers (5) 
Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561