GHSA-fqrq-xmxj-v47x

ghsaUSosv

Mattermost Fails to Properly Perform Viewer Role Authorization

view advisory published 2025-03-19Licence: CC-BY-4.0

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-1472US	—OT elevated	0.25% (17th)	—	2025-03-19
Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-1472ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan