GHSA-86jg-35xj-3vv5

Source

https://github.com/advisories/GHSA-86jg-35xj-3vv5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-86jg-35xj-3vv5/GHSA-86jg-35xj-3vv5.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-86jg-35xj-3vv5

Aliases

Published

2025-05-30T15:30:32Z

Modified

2025-06-03T18:44:29.237151Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Mattermost fails to properly enforce access control restrictions for System Manager roles

Details

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Database specific

{
    "nvd_published_at": "2025-05-30T15:15:41Z",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-30T18:48:31Z",
    "severity": "LOW",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

10.6.0-rc1

Fixed

10.7.1

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

10.0.0-rc1

Fixed

10.5.4

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0-rc1

Fixed

9.11.13

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.0-20250414154356-6f33b721de76