Mattermost Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• Medium 5.4
  CVE-2025-2475

  Unauthorized Bot Login Using Credentials

  Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials.

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 14, 2025
• Medium 4.7
  CVE-2025-32093

  Syatem admin profile modification by delegated granular administration role

  Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform u…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 14, 2025
• Medium 4.3
  CVE-2025-2564

  Unauthorized View Access to Archived Channel Member Info

  Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived ch…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 16, 2025
• Medium 4.3
  CVE-2025-27571

  Channel metadata visible in archived channels despite configuration setting

  Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such i…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 16, 2025
• Low 3.1
  CVE-2025-2424

  Leaked Metadata of Deleted Files via Bookmark Creation

  Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation.

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 14, 2025
• Low 3.1
  CVE-2025-24839

  Unauthorized AI bot activation via Wrangler plugin

  Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 16, 2025
• Low 2.2
  CVE-2025-27538

  MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

  Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for …

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Apr 16, 2025

Revision history

1. 2025-04-22 #3

   CVE, Bewertung und Beschreibung nach Veröffentlichung von Mattermost ergänzt

2. 2025-04-14 #2

   CVE's und Informationen ergänzt

3. 2025-03-17 #1

   Initiale Fassung

References

• Mattermost Security Updates vom 2025-03-17
  https://mattermost.com/security-updates/#server