CVE-2025-22449
Access control flaw for team admins allows unauthorized team additions
Summary
Access control flaw for team admins allows unauthorized team additions
Original description
The description as published by the source.
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com