CVE-2025-3227
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Unauthorized channel member management through playbook runs
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mattermost
- Vendor
- Mattermost
- Product
- Mattermost
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 10.5.0 | affected | semver | Unavailable | 10.5.5 | None listed |
| 9.11.0 | affected | semver | Unavailable | 9.11.15 | None listed |
| 10.8.0 | affected | semver | Unavailable | Unavailable | None listed |
| 10.7.0 | affected | semver | Unavailable | 10.7.2 | None listed |
| 10.6.0 | affected | semver | Unavailable | 10.6.5 | None listed |
| 10.9.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.5.6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 9.11.16 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.8.1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.7.3 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.6.6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |