CVE-2025-53971
Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Summary
Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Original description
The description as published by the source.
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com