CVE-2025-24866
Unauthorized Access to User Activity Logs API by delegated granular administration roles
Summary
Unauthorized Access to User Activity Logs API by delegated granular administration roles
Original description
The description as published by the source.
Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/mattermost/mattermost/server/v8
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.0-20250204211032-f52e08754c49"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web mattermost.com
- web pkg.go.dev