CVE-2025-3446

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 10.6.0, <= 10.6.1; >= 10.5.0, <= 10.5.2; >= 10.4.0, <= 10.4.4; >= 9.11.0, <= 9.11.11

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-344674.3ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorizati CVE-2025-344689.8libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attack CVE-2025-344697.5Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and c CVE-2025-34486.1Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 CVE-2025-344897.8GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/CVE-2025-34494.2A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allo CVE-2025-344906.5GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send CVE-2025-344918.8GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbi CVE-2025-344996.9AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code CVE-2025-345010.0An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an CVE-2025-345007.0Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-code CVE-2025-345017.0Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services