CVE-2025-3913CWE-863

Team Privacy Settings Authorization Bypass in Mattermost Server

Medium · published May 29, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-05-29T15:10Z
EPSS history
Timeline
  • 29 MAY 15:10Z
    Team Privacy Settings Authorization Bypass in Mattermost Server
    cvelistv5