cve.bz

CVE-2025-3913

3.8 lowEPSS 0.3%

Low (3.8) in mattermost mattermost server. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 10.5.4, 10.6.3, 10.7.1.

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

Severity

CVSS 3.1

3.8 low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4mmr-2w8p-whcrGogithub.com/mattermost/mattermost/server/v8>=10.7.0-rc1 <10.7.110.7.1
GHSA-4mmr-2w8p-whcrGogithub.com/mattermost/mattermost/server/v8>=10.6.0-rc1 <10.6.310.6.3
GHSA-4mmr-2w8p-whcrGogithub.com/mattermost/mattermost/server/v8>=10.5.0-rc1 <10.5.410.5.4
GHSA-4mmr-2w8p-whcrGogithub.com/mattermost/mattermost/server/v8>=9.0.0-rc1 <9.11.139.11.13
GHSA-4mmr-2w8p-whcrGogithub.com/mattermost/mattermost/server/v8<8.0.0-20250412152950-02c76784380a8.0.0-20250412152950-02c76784380a
GO-2025-3724Gogithub.com/mattermost/mattermost-server>=9.0.0-rc1+incompatible <9.11.13+incompatible
>=10.5.0-rc1+incompatible <10.5.4+incompatible
>=10.6.0-rc1+incompatible <10.6.3+incompatible
>=10.7.0-rc1+incompatible <10.7.1+incompatible		9.11.13+incompatible, 10.5.4+incompatible, 10.6.3+incompatible, 10.7.1+incompatible
GO-2025-3724Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2025-3724Gogithub.com/mattermost/mattermost-server/v6all versionsno fix published
GO-2025-3724Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20250412152950-02c76784380a8.0.0-20250412152950-02c76784380a

References

Check your stackJSON