Skip to content
OpenAdvisories
Medium · 4.7 CVE-2025-32093 EUVD-2025-10869GHSA-322v-vh2g-qvpvGO-2025-3609

Syatem admin profile modification by delegated granular administration role

Published Apr 14, 2025 · Updated Apr 14, 2025 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost 10.5.0 – ≤ 10.5.1, 10.4.0 – ≤ 10.4.3, 9.11.0 – ≤ 9.11.9 10.6.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250422T181640-1.1 openSUSE-SU-2025:15017-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server >= 10.5.0, < 10.5.2 10.5.2 GHSA-322v-vh2g-qvpv
Go github.com/mattermost/mattermost-server >= 10.4.0, < 10.4.4 10.4.4 GHSA-322v-vh2g-qvpv
Go github.com/mattermost/mattermost-server >= 9.11.0, < 9.11.10 9.11.10 GHSA-322v-vh2g-qvpv
Go github.com/mattermost/mattermost-server >= 9.11.0+incompatible, < 9.11.10+incompatible · >= 10.4.0+incompatible, < 10.4.4+incompatible · >= 10.5.0+incompatible, < 10.5.2+incompatible 9.11.10+incompatible, 10.4.4+incompatible, 10.5.2+incompatible GO-2025-3609
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2025-3609
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2025-3609
Go github.com/mattermost/mattermost/server/v8 >= 10.5.0, < 10.5.2 10.5.2 GHSA-322v-vh2g-qvpv
Go github.com/mattermost/mattermost/server/v8 >= 10.4.0, < 10.4.4 10.4.4 GHSA-322v-vh2g-qvpv
Go github.com/mattermost/mattermost/server/v8 >= 9.11.0, < 9.11.10 9.11.10 GHSA-322v-vh2g-qvpv
Go github.com/mattermost/mattermost/server/v8 < 8.0.0-20250227102013-aa4623a93199 8.0.0-20250227102013-aa4623a93199 GHSA-322v-vh2g-qvpv

Advisories 2

References