| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 10.11.0≥ 10.11.0+incompatible≥ 11.1.0≥ 11.1.0+incompatible≥ 11.2.0≥ 11.2.0+incompatible< 5.3.2-0.20251215190648-6404ab29acc0all versions | 5.3.2-0.20251215190648-6404ab29acc0 |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | < 8.0.0-20251215190648-6404ab29acc0 | 8.0.0-20251215190648-6404ab29acc0 |
| mattermost server | ≥ 10.11.0, < 10.11.10 | 10.11.10 |
Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free