Vulnerability Database

299,758

Total vulnerabilities in the database

CVE-2025-22449

Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.

Published: Jan 9, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-22449
GHSA: GHSA-q8fg-cp3q-5jwm
Severity: Low
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.6
github.com/mattermost/mattermost/server/v8	-	8.0.0-20250102081831-64c566a8280b

https://mattermost.com/security-updates

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo