GitStock

mattermost/mattermost · Security

Mattermost fails to properly enforce access control restrictions for System Manager roles

Open GitHub
GHSA ID
GHSA-86jg-35xj-3vv5
CVE ID
CVE-2025-3611
Severity
low
Published
Updated
CVSS
3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3
3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

CWEs

  • CWE-863 · Incorrect Authorization

References