Moole Vulnerability Database

Find real vulnerabilities before they ship

Low

CVE-2025-14573

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

VectorNETWORK

PublishedFeb 16, 2026, 13:16

Published Byresponsibledisclosure@mattermost.com

Base Score

Score2.7

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/mattermost/mattermost/server/v8(Go)08.0.0-20251215190648-6404ab29acc0N/A

github.com/mattermost/mattermost-server(Go)11.1.0N/AN/A

github.com/mattermost/mattermost-server(Go)10.11.0N/AN/A

github.com/mattermost/mattermost-server(Go)11.2.0N/AN/A

github.com/mattermost/mattermost-server(Go)05.3.2-0.20251215190648-6404ab29acc0N/A

References

https://mattermost.com/security-updates

Weakness Type

CWE-862

CVSS Metrics

Base Score

2.7

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Base SeverityLow

Version

3.1

Attack Vector (AV)

NETWORK