Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-3913GO-2025-3724GHSA-4MMR-2W8P-WHCR

Team Privacy Settings Authorization Bypass in Mattermost Server

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 9.11.13+incompatible, 10.5.4+incompatible, 10.6.3+incompatible, 10.7.1+incompatible, 8.0.0-20250412152950-02c76784380a, and 4 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated

Affected versions

  • Mattermost Mattermost

    From 10.6.0 · through 10.6.2; From 10.5.0 · through 10.5.3; From 9.11.0 · through 9.11.12

  • github.com/mattermost/mattermost-serverGo

    From 9.0.0-rc1+incompatible · fixed in 9.11.13+incompatible; From 10.5.0-rc1+incompatible · fixed in 10.5.4+incompatible; From 10.6.0-rc1+incompatible · fixed in 10.6.3+incompatible; From 10.7.0-rc1+incompatible · fixed in 10.7.1+incompatible

  • github.com/mattermost/mattermost-server/v5Go

    All versions

  • github.com/mattermost/mattermost-server/v6Go

    All versions

  • github.com/mattermost/mattermost/server/v8Go

    fixed in 8.0.0-20250412152950-02c76784380a

  • github.com/mattermost/mattermost/server/v8Go

    From 10.7.0-rc1 · fixed in 10.7.1

  • github.com/mattermost/mattermost/server/v8Go

    From 10.6.0-rc1 · fixed in 10.6.3

  • github.com/mattermost/mattermost/server/v8Go

    From 10.5.0-rc1 · fixed in 10.5.4

  • github.com/mattermost/mattermost/server/v8Go

    From 9.0.0-rc1 · fixed in 9.11.13

References 1

mattermost.com