PT-2025-42442 · Mattermost · Mattermost

Lordwillmore · Published 2025-10-16 · Updated 2025-11-07 · CVE-2025-10545

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.11.x through 10.11.2

Description The software does not correctly check permissions for guest users when adding members to channels. This allows guest users to add any team member to their private channels. The issue occurs through the /api/v4/channels/{channel id}/members API endpoint. The vulnerable parameter is channel id.

Recommendations Update Mattermost to a version later than 10.5.10. Update Mattermost to a version later than 10.11.2.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-10545

GHSA-424H-XJ87-M937

GO-2025-4030

OPENSUSE-SU-2025:15710-1

Affected Products

Mattermost

References · 86

• https://nvd.nist.gov/vuln/detail/CVE-2025-10545 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10545 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4030 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-424h-xj87-m937 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/fb9c583f5e466a566a5122154ef337bbf2238902 · Note
• https://github.com/mattermost/mattermost/pull/33827 · Note
• https://github.com/mattermost/mattermost/pull/31319 · Note
• https://github.com/mattermost/mattermost/commit/ff30b84049f0193f0570d30e46cffc3602298c67 · Note
• https://suse.com/security/cve/CVE-2025-58356 · Note
• https://suse.com/security/cve/CVE-2025-61141 · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note
• https://suse.com/security/cve/CVE-2025-62375 · Note