Security Advisory

CVE-2025-3611

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-05-30 14:22:09

Last updated 2025-05-30 14:37:42

Assigner Mattermost

State PUBLISHED

Description

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with No access to Teams in the System Console.

← Browse all CVEs View on cve.org ↗