CVE-2025-2570

LOW2.7EPSS 0.22%

Mattermost Fails to Check User Access to `ExperimentalSettings`

Published: 5/15/2025Modified: 5/23/2025

Also known as:GHSA-fpff-wj6m-grvrGO-2025-3694

Description

Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

Affected packages (5)

Go/github.com/mattermost/mattermost-server>= 9.11.0+incompatible, < 9.11.12+incompatible, >= 10.5.0+incompatible, < 10.5.3+incompatible
Go/github.com/mattermost/mattermost-server/v5from 0
Go/github.com/mattermost/mattermost-server/v6from 0
Go/github.com/mattermost/mattermost/server/v8>= 10.5.0, < 10.5.3
Go/github.com/mattermost/mattermost/server/v8from 0, < 8.0.0-20250411064244-844447fbd57c

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	LOW2.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References (4)

ADVISORYhttps://github.com/advisories/GHSA-fpff-wj6m-grvr
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-2570
PATCHhttps://github.com/mattermost/mattermost
WEBhttps://mattermost.com/security-updates