Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2025-2570

System Admin Cannot Access Environment settings in System Console While System Manager Can

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 10.5.0 to ≤ 10.5.2affected
  • 9.11.0 to ≤ 9.11.11affected
  • 10.7.0unaffected
  • 10.5.3unaffected
  • 9.11.12unaffected

References