CVE-2025-22449
Access control flaw for team admins allows unauthorized team additions
Résumé
Access control flaw for team admins allows unauthorized team additions
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com