Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Summary

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Timeline

1. May 30, 2025, 2:22 PM UTCCVE published
2. May 30, 2025, 2:37 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. May 30, 2025, 2:37 PM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 10.5.0 · through 10.5.3; From 9.11.0 · through 9.11.12

• github.com/mattermost/mattermost/server/v8Go

  From 10.6.0-rc1 · fixed in 10.7.1

• github.com/mattermost/mattermost/server/v8Go

  From 10.0.0-rc1 · fixed in 10.5.4

• github.com/mattermost/mattermost/server/v8Go

  From 9.0.0-rc1 · fixed in 9.11.13

• github.com/mattermost/mattermost/server/v8Go

  fixed in 8.0.0-20250414154356-6f33b721de76

• github.com/mattermost/mattermost-serverGo

  From 9.0.0-rc1+incompatible · fixed in 9.11.13+incompatible; From 10.0.0-rc1+incompatible · fixed in 10.5.4+incompatible; From 10.6.0-rc1+incompatible · fixed in 10.7.1+incompatible

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

References 1