{"id":"EUVD-2025-34728","enisaUuid":"08cd4c10-559f-330a-84f2-0d9395cd5c89","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.10, 10.11.x \u003c\u003d 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint","datePublished":"Oct 16, 2025, 8:24:25 AM","dateUpdated":"Oct 16, 2025, 2:14:09 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-10545\nGHSA-424h-xj87-m937\n","assigner":"Mattermost","epss":0.33,"enisaIdProduct":[{"id":"4a3d234d-d215-3431-bc78-3051c2a938b1","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.2"},{"id":"ca9b7871-d775-33c3-9403-da10e2a109b0","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.10"}],"enisaIdVendor":[{"id":"8df6e145-6a0d-3233-9232-6779c8849d32","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"1ac964ce-f801-3da2-89e4-e14542954366","vulnerability":{"id":"GHSA-424h-xj87-m937","description":"Mattermost has an Incorrect Authorization vulnerability","datePublished":"Oct 16, 2025, 9:30:24 AM","dateUpdated":"Oct 16, 2025, 8:59:09 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-10545\nhttps://github.com/mattermost/mattermost/pull/31319\nhttps://github.com/mattermost/mattermost/pull/33827\nhttps://github.com/mattermost/mattermost/commit/fb9c583f5e466a566a5122154ef337bbf2238902\nhttps://github.com/mattermost/mattermost/commit/ff30b84049f0193f0570d30e46cffc3602298c67\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-34728\n","aliases":"GHSA-424h-xj87-m937\nCVE-2025-10545\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b27ac9f8-721d-3a66-80a3-606ae7f98aba","vulnerability":{"id":"CVE-2025-10545","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.10, 10.11.x \u003c\u003d 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint","datePublished":"Oct 16, 2025, 8:24:25 AM","dateUpdated":"Oct 16, 2025, 2:14:09 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-34728\n","assigner":"Mattermost","epss":0.33,"dataProcessed":"Nov 4, 2026, 7:16:03 AM","vulnerabilityProduct":[{"id":"171dbdc0-58a8-3737-9110-6e23bed17ce9","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.2"},{"id":"2b1709aa-5713-30dc-9164-261701695942","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.10"}],"vulnerabilityVendor":[{"id":"fe36a0fb-44db-306e-853f-94b71da68a4d","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[{"id":"0bdeaaf2-fcd1-3eac-b19a-ff8efdef387a","advisory":{"id":"openSUSE-SU-2025:15710-1","description":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","datePublished":"Nov 7, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:44:36 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15710-1.json\nhttps://www.suse.com/security/cve/CVE-2016-11063/\nhttps://www.suse.com/security/cve/CVE-2016-11066/\nhttps://www.suse.com/security/cve/CVE-2016-11067/\nhttps://www.suse.com/security/cve/CVE-2016-11068/\nhttps://www.suse.com/security/cve/CVE-2016-11069/\nhttps://www.suse.com/security/cve/CVE-2016-11070/\nhttps://www.suse.com/security/cve/CVE-2016-11071/\nhttps://www.suse.com/security/cve/CVE-2016-11072/\nhttps://www.suse.com/security/cve/CVE-2016-11073/\nhttps://www.suse.com/security/cve/CVE-2016-11074/\nhttps://www.suse.com/security/cve/CVE-2016-11075/\nhttps://www.suse.com/security/cve/CVE-2016-11076/\nhttps://www.suse.com/security/cve/CVE-2016-11077/\nhttps://www.suse.com/security/cve/CVE-2016-11078/\nhttps://www.suse.com/security/cve/CVE-2016-11079/\nhttps://www.suse.com/security/cve/CVE-2016-11080/\nhttps://www.suse.com/security/cve/CVE-2016-11081/\nhttps://www.suse.com/security/cve/CVE-2016-11082/\nhttps://www.suse.com/security/cve/CVE-2016-11083/\nhttps://www.suse.com/security/cve/CVE-2016-11084/\nhttps://www.suse.com/security/cve/CVE-2017-18872/\nhttps://www.suse.com/security/cve/CVE-2023-32199/\nhttps://www.suse.com/security/cve/CVE-2024-58269/\nhttps://www.suse.com/security/cve/CVE-2025-10545/\nhttps://www.suse.com/security/cve/CVE-2025-10678/\nhttps://www.suse.com/security/cve/CVE-2025-10954/\nhttps://www.suse.com/security/cve/CVE-2025-11374/\nhttps://www.suse.com/security/cve/CVE-2025-11375/\nhttps://www.suse.com/security/cve/CVE-2025-11579/\nhttps://www.suse.com/security/cve/CVE-2025-11621/\nhttps://www.suse.com/security/cve/CVE-2025-12044/\nhttps://www.suse.com/security/cve/CVE-2025-26625/\nhttps://www.suse.com/security/cve/CVE-2025-27093/\nhttps://www.suse.com/security/cve/CVE-2025-41410/\nhttps://www.suse.com/security/cve/CVE-2025-41443/\nhttps://www.suse.com/security/cve/CVE-2025-54286/\nhttps://www.suse.com/security/cve/CVE-2025-54287/\nhttps://www.suse.com/security/cve/CVE-2025-54288/\nhttps://www.suse.com/security/cve/CVE-2025-54289/\nhttps://www.suse.com/security/cve/CVE-2025-54290/\nhttps://www.suse.com/security/cve/CVE-2025-54291/\nhttps://www.suse.com/security/cve/CVE-2025-54293/\nhttps://www.suse.com/security/cve/CVE-2025-54469/\nhttps://www.suse.com/security/cve/CVE-2025-54470/\nhttps://www.suse.com/security/cve/CVE-2025-54471/\nhttps://www.suse.com/security/cve/CVE-2025-54499/\nhttps://www.suse.com/security/cve/CVE-2025-58073/\nhttps://www.suse.com/security/cve/CVE-2025-58075/\nhttps://www.suse.com/security/cve/CVE-2025-58356/\nhttps://www.suse.com/security/cve/CVE-2025-59043/\nhttps://www.suse.com/security/cve/CVE-2025-59048/\nhttps://www.suse.com/security/cve/CVE-2025-59530/\nhttps://www.suse.com/security/cve/CVE-2025-59836/\nhttps://www.suse.com/security/cve/CVE-2025-59937/\nhttps://www.suse.com/security/cve/CVE-2025-61141/\nhttps://www.suse.com/security/cve/CVE-2025-61524/\nhttps://www.suse.com/security/cve/CVE-2025-61581/\nhttps://www.suse.com/security/cve/CVE-2025-61688/\nhttps://www.suse.com/security/cve/CVE-2025-62156/\nhttps://www.suse.com/security/cve/CVE-2025-62157/\nhttps://www.suse.com/security/cve/CVE-2025-62375/\nhttps://www.suse.com/security/cve/CVE-2025-62506/\nhttps://www.suse.com/security/cve/CVE-2025-62513/\nhttps://www.suse.com/security/cve/CVE-2025-62705/\nhttps://www.suse.com/security/cve/CVE-2025-62714/\nhttps://www.suse.com/security/cve/CVE-2025-62725/\nhttps://www.suse.com/security/cve/CVE-2025-62820/\nhttps://www.suse.com/security/cve/CVE-2025-64101/\nhttps://www.suse.com/security/cve/CVE-2025-64102/\nhttps://www.suse.com/security/cve/CVE-2025-64103/\n","aliases":"CVE-2016-11063\nCVE-2016-11066\nCVE-2016-11067\nCVE-2016-11068\nCVE-2016-11069\nCVE-2016-11070\nCVE-2016-11071\nCVE-2016-11072\nCVE-2016-11073\nCVE-2016-11074\nCVE-2016-11075\nCVE-2016-11076\nCVE-2016-11077\nCVE-2016-11078\nCVE-2016-11079\nCVE-2016-11080\nCVE-2016-11081\nCVE-2016-11082\nCVE-2016-11083\nCVE-2016-11084\nCVE-2017-18872\nCVE-2023-32199\nCVE-2024-58269\nCVE-2025-10545\nCVE-2025-10678\nCVE-2025-10954\nCVE-2025-11374\nCVE-2025-11375\nCVE-2025-11579\nCVE-2025-11621\nCVE-2025-12044\nCVE-2025-26625\nCVE-2025-27093\nCVE-2025-41410\nCVE-2025-41443\nCVE-2025-54286\nCVE-2025-54287\nCVE-2025-54288\nCVE-2025-54289\nCVE-2025-54290\nCVE-2025-54291\nCVE-2025-54293\nCVE-2025-54469\nCVE-2025-54470\nCVE-2025-54471\nCVE-2025-54499\nCVE-2025-58073\nCVE-2025-58075\nCVE-2025-58356\nCVE-2025-59043\nCVE-2025-59048\nCVE-2025-59530\nCVE-2025-59836\nCVE-2025-59937\nCVE-2025-61141\nCVE-2025-61524\nCVE-2025-61581\nCVE-2025-61688\nCVE-2025-62156\nCVE-2025-62157\nCVE-2025-62375\nCVE-2025-62506\nCVE-2025-62513\nCVE-2025-62705\nCVE-2025-62714\nCVE-2025-62725\nCVE-2025-62820\nCVE-2025-64101\nCVE-2025-64102\nCVE-2025-64103\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1a23be4f-881a-3b69-af30-f47e7bd822db","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2ed33f7b-f8d3-3670-bc12-20339a40cad4","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3ff168c0-43f0-3e6a-a46b-90f0b9322304","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6b082ef7-48e6-329d-a108-2122d2ee3fe7","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6df9e33c-98f3-3e85-bd98-4153a1025f74","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"70fcae35-efbf-33bd-b653-2c72a0a85d73","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"73a13c93-e86b-3658-97c0-52e119937024","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"dc8dabed-45c9-3497-b3f5-b41e45657724","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"eb1e91f2-e5cf-3808-8f1f-c394962ed62d","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}