CVE-2025-3611

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-3611
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-3611.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-3611
Aliases
Downstream
Related
Published
2025-05-30T14:22:09.854Z
Modified
2026-07-11T03:55:07.385558332Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions
Details

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Database specific 
{
    "cna_assigner": "Mattermost",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3611.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "10.7.0"
                },
                {
                    "last_affected": "10.7.0"
                },
                {
                    "introduced": "10.5.0"
                },
                {
                    "last_affected": "10.5.3"
                },
                {
                    "introduced": "9.11.0"
                },
                {
                    "last_affected": "9.11.12"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Introduced
0bc2ddd42375a75ab14e63f038165150d4f07659
Fixed
686c1746a0454421742e7fd22f7aecaccd7a0d0a
Introduced
58bd34fd34cbd7d3da777d627b6cffdf8a532930
Fixed
389a3acd5d77daea50ec00ed348e0fae143fc0a7
Introduced
f6b324a9d71843e8f48eba9e90dfbeabcbac1ae7
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:10.7.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:10.7.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:mattermost:mattermost_server:10.7.0:rc1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "9.11.0"
        },
        {
            "fixed": "9.11.13"
        },
        {
            "introduced": "10.5.0"
        },
        {
            "fixed": "10.5.4"
        },
        {
            "introduced": "10.7.0-NA"
        },
        {
            "last_affected": "10.7.0-NA"
        },
        {
            "introduced": "10.7.0-rc2"
        },
        {
            "last_affected": "10.7.0-rc2"
        },
        {
            "introduced": "10.7.0-rc1"
        },
        {
            "last_affected": "10.7.0-rc1"
        }
    ]
}

Affected versions

10.*
10.7.0-NA
10.7.0-rc1
@mattermost/client@10.*
@mattermost/client@10.5.0
@mattermost/client@9.*
@mattermost/client@9.11.0
@mattermost/types@10.*
@mattermost/types@10.5.0
@mattermost/types@9.*
@mattermost/types@9.11.0
v10.*
v10.5.0
v10.5.0-rc6
v10.5.1
v10.5.1-rc1
v10.5.1-rc2
v10.5.2
v10.5.3
v10.5.3-rc1
v10.5.4-rc1
v9.*
v9.11.0
v9.11.0-rc3
v9.11.1
v9.11.1-rc1
v9.11.10
v9.11.10-rc1
v9.11.11
v9.11.11-rc1
v9.11.12
v9.11.12-rc1
v9.11.13-rc1
v9.11.2
v9.11.2-rc1
v9.11.2-rc2
v9.11.3
v9.11.3-rc1
v9.11.3-rc2
v9.11.4
v9.11.4-rc1
v9.11.5
v9.11.5-rc1
v9.11.6
v9.11.6-rc1
v9.11.6-rc2
v9.11.7
v9.11.7-rc1
v9.11.7-rc2
v9.11.7-rc3
v9.11.8
v9.11.9
v9.11.9-rc1
v9.11.9-rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-3611.json"