CVE-2025-32093

MEDIUM

Mattermost 9.11.0-9.11.9, 10.4.0-10.4.3, 10.5.0-10.5.1 - Incorrect Authorization via Granular Admin Permission

Title source: llm
STIX 2.1

Description

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.

References (1)

Core 1
Core References

Scores

CVSS v3 4.7
EPSS 0.0012
EPSS Percentile 30.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (3)
mattermost/mattermost 10.5.0 - 10.5.2Go
mattermost/mattermost-server 10.5.0 - 10.5.2Go
mattermost/mattermost_server 9.11.0 - 9.11.10
Published Apr 14, 2025
Tracked Since Feb 18, 2026