SUSE CVE-2025-22449

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...

CVE-2025-22449

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...

CVE-2025-22449 vulnerabilities

Vulnerabilities for packages: mattermost-fips...

CVE-2025-22449

creationtimestamp| type| source ---|---|--- 2025-01-09 06:57:26+00:00| seen| https://infosec.exchange/users/cve/statuses/113797093478066074 2025-01-09 07:00:51+00:00| seen| https://infosec.exchange/users/cve/statuses/113797106903236698 2025-01-09 07:16:21+00:00| seen|...

CVE-2025-22449

Mattermost Server 9.11.x ≤ 9.11.5 suffers an improper access-control flaw where team admins lacking invite permission can add users by toggling the allow_open_invite flag when a team is made public. Root cause: failure to enforce invite permissions. Affected feature/file: invite mechanism via all...

CVE-2025-22449 Access control flaw for team admins allows unauthorized team additions

Mattermost versions 9.11.x = 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allowopeninvite" field via making their team public...