PT-2025-21326 · Mattermost · Mattermost

0X7Oda7123

·

Published

2025-05-15

·

Updated

2025-05-26

·

CVE-2025-2570

CVSS v3.1

2.7

Low

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.11
Description: The issue arises when a user lacks access to ExperimentalSettings, causing the system to fail in checking the RestrictSystemAdmin setting. This allows a System Manager to access ExperimentSettings even when RestrictSystemAdmin is set to true, which can be done via the System Console.
Recommendations: For Mattermost versions 10.5.x through 10.5.3, update to a version later than 10.5.3 to resolve the issue. For Mattermost versions 9.11.x through 9.11.11, update to a version later than 9.11.11 to resolve the issue. As a temporary workaround, consider restricting access to ExperimentSettings for System Managers until a patch is available.

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-2570
GHSA-FPFF-WJ6M-GRVR
GO-2025-3694
OPENSUSE-SU-2025:15159-1

Affected Products

Mattermost