CVE-2025-53971

published 2025-08-21

CVE-2025-53971: Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to…

Priority P4 15 low 3.8 CVSS 3.1

AV N AC L PR H UI N S U C L I L A N

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 10.5.0 < 10.5.9	10.5.9
github.com	mattermost_mattermost-server	>= 10.5.0+incompatible < 10.5.9+incompatible	10.5.9+incompatible
github.com	mattermost_mattermost-server	>= 9.11.0 < 9.11.18	9.11.18
github.com	mattermost_mattermost-server	>= 9.11.0+incompatible < 9.11.18+incompatible	9.11.18+incompatible
github.com	mattermost_mattermost-server_v5	0 – 5.39.3	—
github.com	mattermost_mattermost-server_v6	0 – 6.7.2	—
github.com	mattermost_mattermost_server_v8	>= 0 < 8.0.0-20250721095846-c602a4a78e1f	8.0.0-20250721095846-c602a4a78e1f
mattermost	mattermost	10.5.0 – 10.5.8	—
mattermost	mattermost	9.11.0 – 9.11.17	—
mattermost	mattermost_server	>= 10.5.0 < 10.5.9	10.5.9
mattermost	mattermost_server	>= 9.11.0 < 9.11.18	9.11.18

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863