CVE-2025-4128 — Incorrect Authorization in Mattermost Mattermost-server

CWE-863 — Incorrect Authorization5 documents4 sources

Severity

4.3MEDIUMNVD

CNA3.1

EPSS

0.1%

top 67.86%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Github.com Mattermost Mattermost-server Github.com Mattermost Mattermost Server V8 Mattermost Server +1 more

Timeline

PublishedJun 11

Description

Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDmattermost/mattermost_server9.11.0 — 9.11.14+1

▶Gogithub.com/mattermost_mattermost-server9.11.0+incompatible — 9.11.14+incompatible+3

▶Gogithub.com/mattermost_mattermost_server_v8< 8.0.0-20250422131222-701ddc896a10

▶CVEListV5mattermost/mattermost10.5.0 — 10.5.4+1

🔴Vulnerability Details

OSV

Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server↗2025-06-11

▶

OSV

Mattermost allows guest users to view information about public teams they are not members of↗2025-06-11

▶

GHSA

Mattermost allows guest users to view information about public teams they are not members of↗2025-06-11

▶

CVEList

Mattermost Guest User Information Disclosure Vulnerability↗2025-06-11

▶