CVE-2025-27715

LOW3.3EPSS 0.17%

Mattermost fail to prompt for explicit approval before adding a team admin to a private channel

發布日:2025/3/21修改日:2025/3/28

也稱為:GHSA-cw7q-5cgc-h3h9BIT-mattermost-2025-27715GO-2025-3555

描述

Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.

受影響套件(6)

Bitnami/mattermost>= 9.11.0, < 10.0.0
Go/github.com/mattermost/mattermost-server>= 9.11.0+incompatible, < 9.11.9+incompatible
Go/github.com/mattermost/mattermost-server/v5from 0
Go/github.com/mattermost/mattermost-server/v6from 0
Go/github.com/mattermost/mattermost/server/v8>= 9.11.0, < 9.11.9
Go/github.com/mattermost/mattermost/server/v8from 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	LOW3.3	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

參考連結(4)

ADVISORYhttps://github.com/advisories/GHSA-cw7q-5cgc-h3h9
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-27715
PATCHhttps://github.com/mattermost/mattermost
WEBhttps://mattermost.com/security-updates