CVE-2025-3446
Members Without Guest Invite Permissions Can Add Guests to Teams
Résumé
Members Without Guest Invite Permissions Can Add Guests to Teams
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com