Upstream information
Description
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.SUSE information
Overall state of this security issue: Resolved
This issue is currently not rated by SUSE as it is not affecting the SUSE Enterprise products.
| CVSS detail | CNA (Mattermost) |
|---|---|
| Base Score | 3.8 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | High |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | Low |
| Integrity Impact | Low |
| Availability Impact | None |
| CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- SUSE-SU-2025:0297-1, published 2025-01-30T14:03:41Z
- openSUSE-SU-2025:14644-1, published Wed Jan 15 18:50:27 2025
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| Container suse/sl-micro/6.1/baremetal-os-container:latest Container suse/sl-micro/6.1/base-os-container:latest Container suse/sl-micro/6.1/kvm-os-container:latest Container suse/sl-micro/6.1/rt-os-container:latest |
| |
| openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2025-14644 |
SUSE Timeline for this CVE
CVE page created: Thu Jan 9 10:00:15 2025CVE page last modified: Fri Oct 24 12:34:15 2025