CVE-2025-27933 Overview
CVE-2025-27933 affects Mattermost Server versions 10.4.x up to 10.4.2, 10.3.x up to 10.3.3, and 9.11.x up to 9.11.8. The vulnerability stems from improper authorization enforcement around channel conversion permissions [CWE-863]. Users granted permission to convert public channels to private can also convert private channels to public. This exposes previously restricted conversation content to broader channel membership than intended. The flaw requires authenticated access with existing channel conversion privileges, limiting exploitation to internal users with elevated permissions in the workspace.
Critical Impact
Authenticated users with public-to-private channel conversion rights can convert private channels to public, exposing confidential team communications to unauthorized workspace members.
Affected Products
- Mattermost Server 10.4.x versions up to and including 10.4.2
- Mattermost Server 10.3.x versions up to and including 10.3.3
- Mattermost Server 9.11.x versions up to and including 9.11.8
Discovery Timeline
- 2025-03-21 - CVE-2025-27933 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27933
Vulnerability Analysis
The vulnerability is an authorization bypass in Mattermost Server's channel conversion functionality. Mattermost supports two channel types: public channels visible to all workspace members and private channels restricted to invited participants. Administrators can grant users permission to convert channels between these visibility states.
The permission model defines separate capabilities for converting public channels to private and converting private channels to public. However, the server fails to enforce these permissions independently. A user granted only the public-to-private conversion permission can invoke the private-to-public conversion action without holding the corresponding permission.
This breaks the least-privilege intent of the permission separation. Private channels commonly host sensitive discussions, and their conversion to public status makes historical messages readable by any workspace member.
Root Cause
The root cause is missing authorization checks in the channel conversion handler. The server validates that the user holds some channel conversion permission but does not verify that the specific permission matches the direction of the requested conversion. This is a broken access control pattern classified under CWE-863: Incorrect Authorization.
Attack Vector
An authenticated Mattermost user with public-to-private channel conversion permission targets a private channel they can access. The user issues a channel conversion API request specifying the private channel identifier and requesting conversion to public. The server processes the request without verifying the user holds the private-to-public conversion permission. All prior messages in the channel become visible to workspace members who join the newly public channel.
No verified exploitation code is publicly available for this issue. Refer to the Mattermost Security Updates advisory for vendor guidance.
Detection Methods for CVE-2025-27933
Indicators of Compromise
- Audit log entries showing channel type changes from private to public performed by users who lack explicit private-to-public conversion permissions.
- Unexpected increases in membership on recently converted channels shortly after a conversion event.
- API calls to channel conversion endpoints originating from accounts that historically only performed public-to-private operations.
Detection Strategies
- Review Mattermost audit logs for channel.type_changed or equivalent events and correlate the acting user's assigned role permissions.
- Alert on any private-to-public conversion where the acting user's role does not include the corresponding permission grant.
- Compare pre-conversion and post-conversion channel membership counts to identify sensitive channels that gained unexpected visibility.
Monitoring Recommendations
- Ingest Mattermost server audit logs into a centralized SIEM or data lake for permission-context correlation.
- Establish baseline conversion activity per role and flag deviations for review by workspace administrators.
- Periodically export channel-type inventory and diff against previous snapshots to identify silent conversions.
How to Mitigate CVE-2025-27933
Immediate Actions Required
- Upgrade Mattermost Server to a fixed release above 10.4.2, 10.3.3, or 9.11.8 as documented in the vendor advisory.
- Audit users with channel conversion permissions and revoke where not operationally required.
- Review recently converted channels and revert any unauthorized private-to-public conversions.
Patch Information
Mattermost has released patched versions addressing this vulnerability. Administrators should consult the Mattermost Security Updates page for exact fixed version numbers matching their deployment branch and apply the upgrade following the vendor's documented procedure.
Workarounds
- Remove the Convert Public Channels to Private permission from non-administrator roles until the server is patched.
- Restrict channel conversion capabilities to a small set of trusted administrators via the System Console role editor.
- Notify workspace members that channel visibility changes will be logged and reviewed during the mitigation window.
# Configuration example
# Review role permissions via the mmctl administrative CLI
mmctl permissions role show channel_admin
mmctl permissions role show system_user
# Remove the public-to-private conversion permission from a role
mmctl permissions remove channel_admin convert_public_channel_to_private
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
