CVE-2025-47870

published 2025-08-21

CVE-2025-47870: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 10.5.0 < 10.5.9	10.5.9
github.com	mattermost_mattermost-server	>= 10.5.0+incompatible < 10.5.9+incompatible	10.5.9+incompatible
github.com	mattermost_mattermost-server	>= 10.8.0 < 10.8.4	10.8.4
github.com	mattermost_mattermost-server	>= 10.8.0+incompatible < 10.8.4+incompatible	10.8.4+incompatible
github.com	mattermost_mattermost-server	>= 10.9.0 < 10.9.3	10.9.3
github.com	mattermost_mattermost-server	>= 10.9.0+incompatible < 10.9.3+incompatible	10.9.3+incompatible
github.com	mattermost_mattermost-server	>= 9.11.0 < 9.11.18	9.11.18
github.com	mattermost_mattermost-server	>= 9.11.0+incompatible < 9.11.18+incompatible	9.11.18+incompatible
github.com	mattermost_mattermost-server_v5	0 – 5.39.3	—
github.com	mattermost_mattermost-server_v6	0 – 6.7.2	—
github.com	mattermost_mattermost_server_v8	>= 0 < 8.0.0-20250708065844-b38e2eccda18	8.0.0-20250708065844-b38e2eccda18
mattermost	mattermost	10.5.0 – 10.5.8	—
mattermost	mattermost	10.8.0 – 10.8.3	—
mattermost	mattermost	10.9.0 – 10.9.2	—
mattermost	mattermost	9.11.0 – 9.11.17	—
mattermost	mattermost_server	>= 10.5.0 < 10.5.9	10.5.9
mattermost	mattermost_server	>= 10.8.0 < 10.8.4	10.8.4
mattermost	mattermost_server	>= 10.9.0 < 10.9.3	10.9.3
mattermost	mattermost_server	>= 9.11.0 < 9.11.18	9.11.18

CWE-306