CVE-2025-53971

🗓️ 21 Aug 2025 07:31:01Reported by MattermostType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 85 Views🌐 WEB

CVE-2025-53971: Mattermost improper authorization lets Team Admins demote Members to Guests via schemeRoles endpoint; affected 10.5.x and 9.11.x.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2025-53971	21 Aug 202508:11	–	circl
CNNVD	Mattermost 安全漏洞	21 Aug 202500:00	–	cnnvd
Cvelist	CVE-2025-53971 Channel and Team Membership APIs inadvertently allow loss of Member privileges.	21 Aug 202507:31	–	cvelist
EUVD	EUVD-2025-25413	3 Oct 202520:07	–	euvd
Github Security Blog	Mattermost Fails to Properly Validate Team Role Modification	21 Aug 202509:30	–	github
Tenable Nessus	Mattermost Server 9.11.x < 9.11.18 / 10.5.x < 10.5.9 / 10.10.0 Incorrect Authorization (MMSA-2025-00485)	12 Sep 202500:00	–	nessus
NVD	CVE-2025-53971	21 Aug 202508:15	–	nvd
OSV	GHSA-4276-CM8C-788H Mattermost Fails to Properly Validate Team Role Modification	21 Aug 202509:30	–	osv
OSV	GO-2025-3902 Mattermost Fails to Properly Validate Team Role Modification in github.com/mattermost/mattermost-server	29 Aug 202514:52	–	osv
Positive Technologies	PT-2025-34197 · Mattermost · Mattermost	21 Aug 202500:00	–	ptsecurity

NVD

Node

mattermost mattermost_serverRange9.11.0–9.11.18

mattermost mattermost_serverRange10.5.0–10.5.9

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "10.5.8",
        "status": "affected",
        "version": "10.5.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.11.17",
        "status": "affected",
        "version": "9.11.0",
        "versionType": "semver"
      },
      {
        "version": "10.10.0",
        "status": "unaffected"
      },
      {
        "version": "10.5.9",
        "status": "unaffected"
      },
      {
        "version": "9.11.18",
        "status": "unaffected"
      }
    ]
  }
]

Source	Link
mattermost	www.mattermost.com/security-updates

Parameter	Position	Path	Description	CWE
team-id	request body	/api/v4/teams/team-id/members/user-id/schemeRoles	Improper authorization allows Team Admins to demote Team Members to Guests via PUT /api/v4/teams/{team-id}/members/{user-id}/schemeRoles.	CWE-863
user-id	request body	/api/v4/teams/team-id/members/user-id/schemeRoles	Improper authorization allows Team Admins to demote Team Members to Guests via PUT /api/v4/teams/{team-id}/members/{user-id}/schemeRoles.	CWE-863
schemeRoles	request body	/api/v4/teams/team-id/members/user-id/schemeRoles	Improper authorization allows Team Admins to demote Team Members to Guests via PUT /api/v4/teams/{team-id}/members/{user-id}/schemeRoles.	CWE-863

17 Jun 2026 09:39Current

7.1High risk

Vulners AI Score7.1

CVSS 3.13.8

EPSS0.00189

SSVC

CWE-863