GHSA-r7r2-m3vr-c8qcMediumCVSS 4.3

Mattermost Fails to Validate Team Invite Permissions

Published
May 15, 2025
Last Modified
May 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-3446 →

📋 Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

🎯 Affected products5

  • go/github.com/mattermost/mattermost/server/v8:>= 10.6.0, <= 10.6.1
  • go/github.com/mattermost/mattermost/server/v8:>= 10.5.0, <= 10.5.2
  • go/github.com/mattermost/mattermost/server/v8:>= 10.4.0, <= 10.4.4
  • go/github.com/mattermost/mattermost/server/v8:>= 9.11.0, <= 9.11.11
  • go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250415054241-76ab3867b785

🔗 References (3)