PT-2025-12407 · Mattermost · Mattermost

Joram Wilander · Published 2025-03-21 · Updated 2025-03-28 · CVE-2025-27715

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.8

Description The issue concerns the lack of explicit approval before adding a team admin to a private channel. This allows team admins to join private channels via crafted permalink links without explicit consent.

Recommendations For Mattermost versions 9.11.x through 9.11.8, consider restricting access to private channels until a fix is available, and ensure that team admins are aware of the potential for unauthorized access to these channels.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-MATTERMOST-2025-27715

CVE-2025-27715

GHSA-CW7Q-5CGC-H3H9

GO-2025-3555

OPENSUSE-SU-2025:14937-1

Affected Products

Mattermost

References · 45

• https://osv.dev/vulnerability/GHSA-cw7q-5cgc-h3h9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27715 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mattermost-2025-27715 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3555 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27715 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB · Note
• https://suse.com/security/cve/CVE-2024-9900 · Note
• https://github.com/advisories/GHSA-cw7q-5cgc-h3h9 · Note
• https://suse.com/security/cve/CVE-2024-25132 · Note
• https://suse.com/security/cve/CVE-2025-30204 · Note
• https://twitter.com/Hossted_OSS/status/1904038727459942471 · Twitter Post
• https://suse.com/security/cve/CVE-2024-53348 · Note