CVE-2025-14573 | THREATINT

Description

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

PUBLISHED Reserved 2025-12-12 | Published 2026-02-16 | Updated 2026-02-17 | Assigner Mattermost

LOW: 3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Problem types

CWE-862: Missing Authorization

Product status

Default status

unaffected

10.11.0 (semver)

affected

11.3.0

unaffected

10.11.10

unaffected

Credits

omarAhmed1 finder

References

mattermost.com/security-updates (MMSA-2025-00561) vendor-advisory

cve.org (CVE-2025-14573)

nvd.nist.gov (CVE-2025-14573)

Download JSON