CVE-2025-27715
published 2025-03-21CVE-2025-27715: Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private…
PriorityP49low2.7CVSS 3.1
AVNACLPRHUINSUCNILAN
EPSS
0.20%
10.2th percentile
Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 9.11.0+incompatible < 9.11.9+incompatible | 9.11.9+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 9.11.0 < 9.11.9 | 9.11.9 |
| mattermost | mattermost | 9.11.0 – 9.11.8 | — |
| mattermost | mattermost_server | >= 9.11.0 < 9.11.9 | 9.11.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
osv·2025-03-25
CVE-2025-27715 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server
OSV
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel
osv·2025-03-21
CVE-2025-27715 [LOW] Mattermost fail to prompt for explicit approval before adding a team admin to a private channel
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel
Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.
GHSA
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel
ghsa·2025-03-21
CVE-2025-27715 [LOW] CWE-863 Mattermost fail to prompt for explicit approval before adding a team admin to a private channel
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel
Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-21
Published