CVE-2025-14573CWE-862

Team Admin Bypass of Invite Permissions via allow_open_invite Field

Low · published February 16, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-16T12:25Z
EPSS history
Timeline
  • 16 FEB 12:25Z
    Team Admin Bypass of Invite Permissions via allow_open_invite Field
    cvelistv5