CVE-2025-1472 — Unauthorized View Access to Site Statistics and Team Statistics

CVE-2025-1472

Unauthorized View Access to Site Statistics and Team Statistics PUBLISHED

Description (CNA)

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.11.0 through 9.11.8; unaffected 10.5.0; unaffected 9.11.9

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.