CVE-2025-1472CWE-863

Unauthorized View Access to Site Statistics and Team Statistics

Medium · published March 19, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-03-19T14:11Z
EPSS history
Timeline
  • 19 MAR 14:11Z
    Unauthorized View Access to Site Statistics and Team Statistics
    cvelistv5