cve.bz

CVE-2025-14573

2.7 lowEPSS 0.2%

Low (2.7) in mattermost mattermost server. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 8.0.0-20251215190648-6404ab29acc0.

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

Severity

CVSS 3.1

2.7 low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
CWE
CWE-862
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-cgjg-p2m2-qm4pGogithub.com/mattermost/mattermost/server/v8<8.0.0-20251215190648-6404ab29acc08.0.0-20251215190648-6404ab29acc0
GHSA-cgjg-p2m2-qm4pGogithub.com/mattermost/mattermost-server>=11.1.0no fix published
GHSA-cgjg-p2m2-qm4pGogithub.com/mattermost/mattermost-server>=10.11.0no fix published
GHSA-cgjg-p2m2-qm4pGogithub.com/mattermost/mattermost-server>=11.2.0no fix published
GHSA-cgjg-p2m2-qm4pGogithub.com/mattermost/mattermost-server<5.3.2-0.20251215190648-6404ab29acc05.3.2-0.20251215190648-6404ab29acc0
GO-2026-4523Gogithub.com/mattermost/mattermost-serverall versionsno fix published
GO-2026-4523Gogithub.com/mattermost/mattermost-server>=10.11.0+incompatibleno fix published
GO-2026-4523Gogithub.com/mattermost/mattermost-server>=11.1.0+incompatibleno fix published
GO-2026-4523Gogithub.com/mattermost/mattermost-server>=11.2.0+incompatibleno fix published
GO-2026-4523Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2026-4523Gogithub.com/mattermost/mattermost-server/v6all versionsno fix published
GO-2026-4523Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20251215190648-6404ab29acc08.0.0-20251215190648-6404ab29acc0

References

Check your stackJSON