GitHub Advisoryadvisory · Go

GHSA-fqrq-xmxj-v47x Mattermost Fails to Properly Perform Viewer Role Authorization

MEDIUM Published 2025-03-19 Modified 2025-03-19 Official page ↗
Aliases
CVE-2025-1472
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-03-19

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 9.11.0, < 9.11.9 → fixed in 9.11.9 • Go github.com/mattermost/mattermost-server: >= 9.11.0, < 9.11.9 → fixed in 9.11.9

Description

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

Related

Alias · CVE (1)

  • CVE-2025-1472 Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References