CVE-2025-22449

Published Jan 9, 2025

Last updated a month ago

Overview

Description: Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
Source: responsibledisclosure@mattermost.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 3.8
Impact score: 2.5
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Severity: LOW

Weaknesses

responsibledisclosure@mattermost.com: CWE-863

Hype score: Not currently trending

CVE-2025-22449 Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users b… https://t.co/i0dJW1LoUs
@CVEnew
9 Jan 2025
174 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes

References