CVE-2025-22449 — Access control flaw for team admins allows unauthorized team additions

CVE-2025-22449

Access control flaw for team admins allows unauthorized team additions PUBLISHED

Description (CNA)

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.11.0 through 9.11.5; unaffected 10.3.0; unaffected 9.11.6

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.