GHSA-fqrq-xmxj-v47x

Source

https://github.com/advisories/GHSA-fqrq-xmxj-v47x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-fqrq-xmxj-v47x/GHSA-fqrq-xmxj-v47x.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-fqrq-xmxj-v47x

Aliases

CVE-2025-1472
GO-2025-3534

Published

2025-03-19T15:31:45Z

Modified

2025-03-25T20:08:33.576676Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Mattermost Fails to Properly Perform Viewer Role Authorization

Details

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

Database specific

{
    "nvd_published_at": "2025-03-19T15:15:53Z",
    "github_reviewed_at": "2025-03-19T21:52:19Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

9.11.0

Fixed

9.11.9

Go / github.com/mattermost/mattermost-server

Package

Name: github.com/mattermost/mattermost-server; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type: SEMVER
Events: Introduced

9.11.0

Fixed

9.11.9