PT-2026-8341 · Mattermost · Mattermost

Omarahmed1 · Published 2026-02-16 · Updated 2026-03-03 · CVE-2025-14573

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.9

Description Mattermost versions 10.11.x up to and including 10.11.9 do not properly enforce invite permissions when team settings are updated. This allows team administrators lacking the necessary permissions to circumvent restrictions and add users to their team using API requests. The issue involves bypassing intended limitations through the ''/api/teams/{team id}'' endpoint when updating team settings, specifically related to the allow open invite field.

Recommendations Update Mattermost to a version later than 10.11.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14573

GHSA-CGJG-P2M2-QM4P

GO-2026-4523

SUSE-SU-2026:0757-1

Affected Products

Mattermost

References · 116

• https://osv.dev/vulnerability/GO-2026-4523 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgjg-p2m2-qm4p · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14573 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14573 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/6404ab29acc04901c5cb1cf5ad97fc3c0693e2cd · Note
• https://suse.com/security/cve/CVE-2025-64111 · Note
• https://suse.com/security/cve/CVE-2026-0998 · Note
• https://suse.com/security/cve/CVE-2026-22892 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://suse.com/security/cve/CVE-2026-21434 · Note
• https://suse.com/security/cve/CVE-2026-25760 · Note
• https://suse.com/security/cve/CVE-2025-13821 · Note