Skip to content
CVE PROGRAM SOURCE RECORD3.8 Low

CVE-2025-22449

Access control flaw for team admins allows unauthorized team additions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 9.11.0 to ≤ 9.11.5affected
  • 10.3.0unaffected
  • 9.11.6unaffected

References