cve.bz

CVE-2025-3446

4.3 mediumEPSS 0.3%

Medium (4.3) in mattermost mattermost server. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 10.4.5, 10.5.3, 10.6.2.

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-r7r2-m3vr-c8qcGogithub.com/mattermost/mattermost/server/v8>=10.6.0 <10.6.210.6.2
GHSA-r7r2-m3vr-c8qcGogithub.com/mattermost/mattermost/server/v8>=10.5.0 <10.5.310.5.3
GHSA-r7r2-m3vr-c8qcGogithub.com/mattermost/mattermost/server/v8>=10.4.0 <10.4.510.4.5
GHSA-r7r2-m3vr-c8qcGogithub.com/mattermost/mattermost/server/v8>=9.11.0 <9.11.129.11.12
GHSA-r7r2-m3vr-c8qcGogithub.com/mattermost/mattermost/server/v8<8.0.0-20250415054241-76ab3867b7858.0.0-20250415054241-76ab3867b785
GO-2025-3693Gogithub.com/mattermost/mattermost-server>=9.11.0+incompatible <9.11.12+incompatible
>=10.4.0+incompatible <10.4.5+incompatible
>=10.5.0+incompatible <10.5.3+incompatible
>=10.6.0+incompatible <10.6.2+incompatible		9.11.12+incompatible, 10.4.5+incompatible, 10.5.3+incompatible, 10.6.2+incompatible
GO-2025-3693Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2025-3693Gogithub.com/mattermost/mattermost-server/v6all versionsno fix published
GO-2025-3693Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20250415054241-76ab3867b7858.0.0-20250415054241-76ab3867b785

References

Check your stackJSON