CVE-2025-47870
published 2025-08-21CVE-2025-47870: Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.21%
12.1th percentile
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.5.0 < 10.5.9 | 10.5.9 |
| github.com | mattermost_mattermost-server | >= 10.5.0+incompatible < 10.5.9+incompatible | 10.5.9+incompatible |
| github.com | mattermost_mattermost-server | >= 10.8.0 < 10.8.4 | 10.8.4 |
| github.com | mattermost_mattermost-server | >= 10.8.0+incompatible < 10.8.4+incompatible | 10.8.4+incompatible |
| github.com | mattermost_mattermost-server | >= 10.9.0 < 10.9.3 | 10.9.3 |
| github.com | mattermost_mattermost-server | >= 10.9.0+incompatible < 10.9.3+incompatible | 10.9.3+incompatible |
| github.com | mattermost_mattermost-server | >= 9.11.0 < 9.11.18 | 9.11.18 |
| github.com | mattermost_mattermost-server | >= 9.11.0+incompatible < 9.11.18+incompatible | 9.11.18+incompatible |
| github.com | mattermost_mattermost-server_v5 | 0 – 5.39.3 | — |
| github.com | mattermost_mattermost-server_v6 | 0 – 6.7.2 | — |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20250708065844-b38e2eccda18 | 8.0.0-20250708065844-b38e2eccda18 |
| mattermost | mattermost | 10.5.0 – 10.5.8 | — |
| mattermost | mattermost | 10.8.0 – 10.8.3 | — |
| mattermost | mattermost | 10.9.0 – 10.9.2 | — |
| mattermost | mattermost | 9.11.0 – 9.11.17 | — |
| mattermost | mattermost_server | >= 10.5.0 < 10.5.9 | 10.5.9 |
| mattermost | mattermost_server | >= 10.8.0 < 10.8.4 | 10.8.4 |
| mattermost | mattermost_server | >= 10.9.0 < 10.9.3 | 10.9.3 |
| mattermost | mattermost_server | >= 9.11.0 < 9.11.18 | 9.11.18 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server
osv·2025-08-29
CVE-2025-47870 Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server
Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server
Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server
OSV
Mattermost Does Not Sanitize the Team Invite ID
osv·2025-08-21
CVE-2025-47870 [MEDIUM] Mattermost Does Not Sanitize the Team Invite ID
Mattermost Does Not Sanitize the Team Invite ID
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.
GHSA
Mattermost Does Not Sanitize the Team Invite ID
ghsa·2025-08-21
CVE-2025-47870 [MEDIUM] CWE-306 Mattermost Does Not Sanitize the Team Invite ID
Mattermost Does Not Sanitize the Team Invite ID
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.9.x <= 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-21
Published