Cloudanix VulnDB

CVE-2025-14573

Low · 3.8

CVSS

3.8

EPSS

0.2%

Published

Feb 16, 2026

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost-server 0 No fix
Go github.com/mattermost/mattermost-server 10.11.0+incompatible No fix
Go github.com/mattermost/mattermost-server 11.1.0+incompatible No fix
Go github.com/mattermost/mattermost-server 11.2.0+incompatible No fix
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20251215190648-6404ab29acc0
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260226T182644-150000.1.149.1

Related vulnerabilities