GHSA-86jg-35xj-3vv5

Suggest an improvement
Source
https://github.com/advisories/GHSA-86jg-35xj-3vv5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-86jg-35xj-3vv5/GHSA-86jg-35xj-3vv5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-86jg-35xj-3vv5
Aliases
Related
Published
2025-05-30T15:30:32Z
Modified
2026-02-04T03:42:50.210297Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Mattermost fails to properly enforce access control restrictions for System Manager roles
Details

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "severity": "LOW",
    "github_reviewed_at": "2025-05-30T18:48:31Z",
    "nvd_published_at": "2025-05-30T15:15:41Z"
}
References

Affected packages

Go
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
10.6.0-rc1
Fixed
10.7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-86jg-35xj-3vv5/GHSA-86jg-35xj-3vv5.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
10.0.0-rc1
Fixed
10.5.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-86jg-35xj-3vv5/GHSA-86jg-35xj-3vv5.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
9.0.0-rc1
Fixed
9.11.13

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-86jg-35xj-3vv5/GHSA-86jg-35xj-3vv5.json"
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.0.0-20250414154356-6f33b721de76

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-86jg-35xj-3vv5/GHSA-86jg-35xj-3vv5.json"