LOW 3.1 Go
Mattermost has an Incorrect Authorization vulnerability
GHSA-424h-xj87-m937 · CVE-2025-10545 · GO-2025-4030
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the /api/v4/channels/{channel_id}/members endpoint
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-10545
- WEB https://github.com/mattermost/mattermost/pull/31319
- WEB https://github.com/mattermost/mattermost/pull/33827
- WEB https://github.com/mattermost/mattermost/commit/fb9c583f5e466a566a5122154ef337bbf2238902
- WEB https://github.com/mattermost/mattermost/commit/ff30b84049f0193f0570d30e46cffc3602298c67
- PACKAGE https://github.com/mattermost/mattermost
- WEB https://mattermost.com/security-updates
Ready to move
Start Securing
Free, no credit card | First findings in minutes