CVE-2025-10545
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-10-21
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.5.0 (inc) to 10.5.11 (exc) |
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost versions 10.5.x up to 10.5.10 and 10.11.x up to 10.11.2, where guest users are not properly validated when adding members to channels. Specifically, guest users can add any team members to their private channels by exploiting the /api/v4/channels/{channel_id}/members endpoint, which should restrict such actions.
How can this vulnerability impact me? :
The vulnerability allows guest users to add any team members to their private channels, potentially exposing private communication channels to unauthorized users. This could lead to unauthorized access to sensitive information shared within private channels.