CVE-2025-3611CWE-863

Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Low · published May 30, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-05-30T14:22Z
EPSS history
Timeline
  • 30 MAY 14:22Z
    Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions
    cvelistv5