VULNERABILITY INTELLIGENCE

CVE-2025-1472

CVSS score4.3 MEDIUM
EPSS probability0.25%
CISA KEVNot currently listed
Published2025-03-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-863

Primary references