Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0261

NIXPKGS-2026-0261
published on 17 Feb 2026
Permalink CVE-2025-14350
updated 4 days, 3 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 4 days, 15 hours ago
  • @LeSuisse removed
    4 packages
    • mattermost-desktop
    • python312Packages.mattermostdriver
    • python313Packages.mattermostdriver
    • python314Packages.mattermostdriver
    4 days, 3 hours ago
  • @LeSuisse removed
    5 maintainers
    • @fsagbuya
    • @Kranzes
    • @numinit
    • @mgdelacroix
    • @ryantm
    4 days, 3 hours ago
  • @LeSuisse accepted 4 days, 3 hours ago
  • @LeSuisse published on GitHub 4 days, 3 hours ago
Information disclosure via channel mentions in posts

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563

Affected products

Mattermost
  • =<10.11.9
  • ==11.3.0
  • ==11.1.3
  • =<11.1.2
  • ==11.2.2
  • =<11.2.1
  • ==10.11.10

Matching in nixpkgs

Package maintainers

Ignored maintainers (5) 
Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561