PT-2025-16221 · Mattermost · Mattermost

Bob10X1 · Published 2025-04-14 · Updated 2025-04-23 · CVE-2025-32093

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.1 Mattermost versions 10.4.x through 10.4.3 Mattermost versions 9.11.x through 9.11.9

Description: The issue arises from the failure to restrict certain operations on system admins to only other system admins. This allows delegated granular administration users with the Edit Other Users permission to perform unauthorized modifications to system administrators via improper permission validation.

Recommendations: For Mattermost versions 10.5.x through 10.5.1, update to a version that properly restricts operations on system admins. For Mattermost versions 10.4.x through 10.4.3, update to a version that properly restricts operations on system admins. For Mattermost versions 9.11.x through 9.11.9, update to a version that properly restricts operations on system admins. As a temporary workaround, consider restricting the Edit Other Users permission to prevent unauthorized modifications to system administrators.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-32093

GHSA-322V-VH2G-QVPV

GO-2025-3609

OPENSUSE-SU-2025:15017-1

Affected Products

Mattermost

References · 38

• https://osv.dev/vulnerability/GO-2025-3609 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32093 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32093 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-322v-vh2g-qvpv · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/aa4623a9319943d9f54383b22b55e7d06a324e20 · Note
• https://twitter.com/CVEnew/status/1911679825019892095 · Twitter Post
• https://pkg.go.dev/vuln/GO-2025-3609 · Note
• https://suse.com/security/cve/CVE-2025-3801 · Note
• https://suse.com/security/cve/CVE-2025-1386 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32093 · Note
• https://t.me/cvetracker/21504 · Telegram Post
• https://suse.com/security/cve/CVE-2025-30206 · Note