GitHub Advisoryadvisory · Go

GHSA-86jg-35xj-3vv5 Mattermost fails to properly enforce access control restrictions for System Manager roles

LOW Published 2025-05-30 Modified 2025-05-30 Official page ↗
Aliases
CVE-2025-3611
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-05-30

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 10.6.0-rc1, < 10.7.1 → fixed in 10.7.1 • Go github.com/mattermost/mattermost/server/v8: >= 10.0.0-rc1, < 10.5.4 → fixed in 10.5.4 • Go github.com/mattermost/mattermost/server/v8: >= 9.0.0-rc1, < 9.11.13 → fixed in 9.11.13 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250414154356-6f33b721de76 → fixed in 8.0.0-20250414154356-6f33b721de76

Description

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Related

Alias · CVE (1)

  • CVE-2025-3611 Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References