PT-2025-27457 · Mattermost · Mattermost
Mrhashimamin
·
Published
2025-06-30
·
Updated
2025-08-04
·
CVE-2025-46702
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Mattermost versions 9.11.x through 9.11.15
Mattermost versions 10.5.x through 10.5.5
Mattermost versions 10.6.x through 10.6.5
Mattermost versions 10.7.x through 10.7.2
Mattermost version 10.8.0
Description:
The issue arises from the improper enforcement of channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions, adding or removing users to/from private channels via the playbook run participants feature. Even when the 'Manage Members' permission has been explicitly removed, this can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges.
Recommendations:
For Mattermost versions 9.11.x through 9.11.15, update to a version later than 9.11.15 to resolve the issue.
For Mattermost versions 10.5.x through 10.5.5, update to a version later than 10.5.5 to resolve the issue.
For Mattermost versions 10.6.x through 10.6.5, update to a version later than 10.6.5 to resolve the issue.
For Mattermost versions 10.7.x through 10.7.2, update to a version later than 10.7.2 to resolve the issue.
For Mattermost version 10.8.0, update to a version later than 10.8.0 to resolve the issue.
Fix
LPE
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mattermost