GitHub Advisoryadvisory · Go

GHSA-cgjg-p2m2-qm4p Mattermost fails to enforce invite permissions when updating team settings

LOW Published 2026-02-16 Modified 2026-02-19 Official page ↗
Aliases
CVE-2025-14573
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-02-19

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20251215190648-6404ab29acc0 → fixed in 8.0.0-20251215190648-6404ab29acc0 • Go github.com/mattermost/mattermost-server: < 11.1.3 (no fix yet) • Go github.com/mattermost/mattermost-server: < 10.11.10 (no fix yet) • Go github.com/mattermost/mattermost-server: < 11.2.2 (no fix yet) • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20251215190648-6404ab29acc0 → fixed in 5.3.2-0.20251215190648-6404ab29acc0

Description

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

Related

Alias · CVE (1)

  • CVE-2025-14573 Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References