CVE-2025-27715

LOW3.3EPSS 0.17%

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

Published: 3/21/2025Modified: 3/28/2025

Also known as:GHSA-cw7q-5cgc-h3h9BIT-mattermost-2025-27715GO-2025-3555

Description

Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.

Affected packages (6)

Bitnami/mattermost>= 9.11.0, < 10.0.0
Go/github.com/mattermost/mattermost-server>= 9.11.0+incompatible, < 9.11.9+incompatible
Go/github.com/mattermost/mattermost-server/v5from 0
Go/github.com/mattermost/mattermost-server/v6from 0
Go/github.com/mattermost/mattermost/server/v8>= 9.11.0, < 9.11.9
Go/github.com/mattermost/mattermost/server/v8from 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	LOW3.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

References (4)

ADVISORYhttps://github.com/advisories/GHSA-cw7q-5cgc-h3h9
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-27715
PATCHhttps://github.com/mattermost/mattermost
WEBhttps://mattermost.com/security-updates