CVE-2025-10545: Guest user can add unauthorized team users to private channels
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the /api/v4/channels/{channelid}/members endpoint
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.11.3 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.5.11 - Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.0.0-20250820115038-ff30b84049f0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.12.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.5.11 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10545?
CVE-2025-10545 is rated as a medium severity vulnerability due to improper validation of guest user permissions.
How do I fix CVE-2025-10545?
To fix CVE-2025-10545, upgrade Mattermost to version 10.5.11 or 10.11.3 or later.
What are the affected versions in CVE-2025-10545?
CVE-2025-10545 affects Mattermost versions 10.5.x up to 10.5.10 and 10.11.x up to 10.11.2.
Who can exploit CVE-2025-10545?
CVE-2025-10545 can be exploited by guest users who can add any team members to their private channels.
What is the impact of CVE-2025-10545?
The impact of CVE-2025-10545 allows unauthorized access to private channels by enabling guest users to add members indiscriminately.