cve.bz

CVE-2025-3611

4.3 mediumEPSS 0.2%

Medium (4.3) in mattermost mattermost server. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 10.5.4, 10.7.1, 8.0.0-20250414154356-6f33b721de76.

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-86jg-35xj-3vv5Gogithub.com/mattermost/mattermost/server/v8>=10.6.0-rc1 <10.7.110.7.1
GHSA-86jg-35xj-3vv5Gogithub.com/mattermost/mattermost/server/v8>=10.0.0-rc1 <10.5.410.5.4
GHSA-86jg-35xj-3vv5Gogithub.com/mattermost/mattermost/server/v8>=9.0.0-rc1 <9.11.139.11.13
GHSA-86jg-35xj-3vv5Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20250414154356-6f33b721de768.0.0-20250414154356-6f33b721de76
GO-2025-3728Gogithub.com/mattermost/mattermost-server>=9.0.0-rc1+incompatible <9.11.13+incompatible
>=10.0.0-rc1+incompatible <10.5.4+incompatible
>=10.6.0-rc1+incompatible <10.7.1+incompatible		9.11.13+incompatible, 10.5.4+incompatible, 10.7.1+incompatible
GO-2025-3728Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2025-3728Gogithub.com/mattermost/mattermost-server/v6all versionsno fix published
GO-2025-3728Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20250414154356-6f33b721de768.0.0-20250414154356-6f33b721de76

References

Check your stackJSON