CVE-2025-53971
Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Résumé
Channel and Team Membership APIs inadvertently allow loss of Member privileges.
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com