Vulnerability Database

299,751

Total vulnerabilities in the database

CVE-2025-24866

Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.

Published: Apr 10, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-24866
GHSA: GHSA-xfq9-hh5x-xfq9
Severity: Low
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.9
github.com/mattermost/mattermost/server/v8	-	8.0.0-20250204211032-f52e08754c49

https://mattermost.com/security-updates
https://pkg.go.dev/vuln/GO-2025-3604

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo