[Error Report] [Mobile Clients: Android & iOS] Mobile client requires create_public_channel permission when creating a private channel

[Zhert-sys]

Subject: Mobile private channel creation returns HTTP 403 when create_public_channel permission is disabled

---

ENVIRONMENT

Mattermost Server:

• Version: 11.7.7 ESR
• Edition: Free / self-hosted

Database:

• PostgreSQL 16.14

Server operating system:

• Ubuntu 24.04 LTS (Noble Numbat)

Mobile clients tested:

• Mattermost iOS 2.42.3
• Mattermost Android 2.42.3

---

Dear Mattermost Development Team,

First of all, I would like to thank all Mattermost developers and contributors for their work and for making Mattermost available as an open-source project to the entire community.

I would like to bring to your attention an issue that we have recently encountered with the Mattermost mobile clients on both iOS and Android.

The issue has been consistently reproduced by multiple users when attempting to create a private channel.

When public channel creation is disabled for standard users, but private channel creation is allowed, users are unable to create a private channel from the mobile application, even when the "Make Private" option is enabled.

The mobile application returns:
"You do not have the appropriate permissions."

The same users, with the same permission configuration, can successfully create private channels using the Mattermost Web client.
The issue was originally observed on Mattermost Server 10.11.19 ESR and remains reproducible after upgrading the server to Mattermost 11.7.7 ESR.

Based on the tests I've run, I can confirm that the behavior is consistently reproducible.
I have no objective technical evidence that the root cause is a bug in the mobile client or elsewhere in the channel creation flow, so I'm providing the collected technical evidence for the Mattermost development team to investigate.

---

CASE STUDY

EXPECTED FLOW

Mobile user
v
Opens "New Channel"
v
Enables "Make Private"
v
Requests creation of a PRIVATE channel
v
POST /api/v4/channels
v
Server evaluates:
create_private_channel
v
Permission available
v
Private channel created

============

OBSERVED FLOW

Mobile user
v
Opens "New Channel"
v
Enables "Make Private"
v
Mobile UI shows the channel as private
v
POST /api/v4/channels
v
Server-side permission evaluation
v
create_public_channel is required
v
Permission intentionally absent
v
HTTP 403
v
"You do not have the appropriate permissions."

---

I have attached an anonymized technical report containing the environment details, reproduction steps, control tests and the relevant server-side logs collected while reproducing the issue.

I hope the information provided can help determine whether this behavior represents a mobile client issue or another problem in the private channel creation flow.

I remain available to perform additional tests or provide further anonymized diagnostic information if required.

I thank you in advance for your attention and availability to anyone who could help me identify the problem in question.

Kind Regards

Mattermost mobile bug report 11-08-26.txt

[LogFlames]

We got the same report from users on our instance on 11.7.8 (failed to create private channels on mobile). This feels important to fix as I think it's quite a common setup where everyone is allowed to create private channels but not public ones. Happy to help debug if helpful on more instances.