Skip to main content

Missing Authorization

CVE-2025-14350

Medium
4.3/10

Summary

Mattermost versions from 10.11.x through 10.11.9, 11.1.x through 11.1.2, and 11.2.x through 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the "channel_mentions" property in the API response. Mattermost Advisory ID: MMSA-2025-00563

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • LOW
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published