CVE-2025-3446 - Members Without Guest Invite Permissions Can Add Guests to Teams

Back Back to CVE browser

MEDIUM

Members Without Guest Invite Permissions Can Add Guests to Teams

Published May 15, 2025

4.3

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
Affected
- ≥ 10.4.0, ≤ 10.4.4
- ≥ 10.5.0, ≤ 10.5.2
- ≥ 10.6.0, ≤ 10.6.1
- ≥ 9.11.0, ≤ 9.11.11
Unaffected
- 10.4.5
- 10.5.3
- 10.6.2
- 10.7.0
- 9.11.12

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mattermost	Mattermost	unaffected	Affected ≥ 10.4.0, ≤ 10.4.4 ≥ 10.5.0, ≤ 10.5.2 ≥ 10.6.0, ≤ 10.6.1 ≥ 9.11.0, ≤ 9.11.11 Unaffected 10.4.5 10.5.3 10.6.2 10.7.0 9.11.12

github.com/mattermost/mattermost/server/v8

Go

Introduced 0 Fixed 8.0.0-20250415054241-76ab3867b785
github.com/mattermost/mattermost-server

Go

Introduced 9.11.0+incompatible Fixed 9.11.12+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.4.0+incompatible Fixed 10.4.5+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.5.0+incompatible Fixed 10.5.3+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 10.6.0+incompatible Fixed 10.6.2+incompatible
github.com/mattermost/mattermost-server/v5

Go

Introduced 0 Fixed not fixed
github.com/mattermost/mattermost-server/v6

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost/server/v8	0	8.0.0-20250415054241-76ab3867b785
Go	github.com/mattermost/mattermost-server	9.11.0+incompatible	9.11.12+incompatible
Go	github.com/mattermost/mattermost-server	10.4.0+incompatible	10.4.5+incompatible
Go	github.com/mattermost/mattermost-server	10.5.0+incompatible	10.5.3+incompatible
Go	github.com/mattermost/mattermost-server	10.6.0+incompatible	10.6.2+incompatible
Go	github.com/mattermost/mattermost-server/v5	0	not fixed
Go	github.com/mattermost/mattermost-server/v6	0	not fixed

Remediation

Vendor solution

Update Mattermost to versions 10.7.0, 10.6.2, 10.5.3, 10.4.5, 9.11.12 or higher.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15149
Advisory
https://github.com/advisories/GHSA-r7r2-m3vr-c8qc
Advisory
https://mattermost.com/security-updates
Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-3446

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-15149		Advisory
https://github.com/advisories/GHSA-r7r2-m3vr-c8qc		Advisory
https://mattermost.com/security-updates		Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-3446