Vulnerability Database

299,751

Total vulnerabilities in the database

CVE-2025-1472

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

Published: Mar 19, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-1472
GHSA: GHSA-fqrq-xmxj-v47x
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.9
github.com/mattermost/mattermost-server	9.11.0	9.11.9

https://mattermost.com/security-updates

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo