CVE-2025-3611 — Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

CVE-2025-3611

Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions PUBLISHED

Description (CNA)

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 10.7.0; affected 10.5.0 through 10.5.3; affected 9.11.0 through 9.11.12; unaffected 10.8.0; unaffected 10.7.1; unaffected 10.5.4; unaffected 9.11.13

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.