Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2025-3611

Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 10.7.0affected
  • 10.5.0 to ≤ 10.5.3affected
  • 9.11.0 to ≤ 9.11.12affected
  • 10.8.0unaffected
  • 10.7.1unaffected
  • 10.5.4unaffected
  • 9.11.13unaffected

References