CVE-2025-32093 — Syatem admin profile modification by delegated granular administration role

CVE-2025-32093

Syatem admin profile modification by delegated granular administration role PUBLISHED

Description (CNA)

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.5.0 through 10.5.1; affected 10.4.0 through 10.4.3; affected 9.11.0 through 9.11.9; unaffected 10.6.0; unaffected 10.5.2; unaffected 10.4.4; unaffected 9.11.10

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.