CVE-2025-53971

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate authorization for team scheme role modifications which allows Team Admins to demote Team Members to Guests via the PUT /api/v4/teams/team-id/members/user-id/schemeRoles API endpoint.

Published: Aug 21, 2025
Updated: Aug 22, 2025
CVE: CVE-2025-53971
GHSA: GHSA-4276-cm8c-788h
Severity: Low
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost-server	10.5.0	10.5.9
github.com/mattermost/mattermost-server	9.11.0	9.11.18
github.com/mattermost/mattermost/server/v8	-	8.0.0-20250721095846-c602a4a78e1f
github.com/mattermost/mattermost-server/v5	-	5.39.3.x
github.com/mattermost/mattermost-server/v6	-	6.7.2.x

https://mattermost.com/security-updates
https://pkg.go.dev/vuln/GO-2025-3902

Vulnerability Database

CVE-2025-53971