CVE-2025-27715 — Auto-Enrollment of Team Admins into Private Channels without explicit consent

CVE-2025-27715

Auto-Enrollment of Team Admins into Private Channels without explicit consent PUBLISHED

Description (CNA)

Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.11.0 through 9.11.8; unaffected 10.5.0; unaffected 9.11.9

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.