CVE-2025-32093: Syatem admin profile modification by delegated granular administration role
First published: Mon Apr 14 2025(Updated: )
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.
Credit: responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mattermost | <=10.5.1<=10.4.3<=9.11.9 | |
| go/github.com/mattermost/mattermost/server/v8 | <8.0.0-20250227102013-aa4623a93199 | 8.0.0-20250227102013-aa4623a93199 |
| go/github.com/mattermost/mattermost/server/v8 | >=9.11.0<9.11.10 | 9.11.10 |
| go/github.com/mattermost/mattermost/server/v8 | >=10.4.0<10.4.4 | 10.4.4 |
| go/github.com/mattermost/mattermost/server/v8 | >=10.5.0<10.5.2 | 10.5.2 |
| go/github.com/mattermost/mattermost-server | >=9.11.0<9.11.10 | 9.11.10 |
| go/github.com/mattermost/mattermost-server | >=10.4.0<10.4.4 | 10.4.4 |
| go/github.com/mattermost/mattermost-server | >=10.5.0<10.5.2 | 10.5.2 |
Remedy
Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-32093?
CVE-2025-32093 has been classified as a critical vulnerability affecting specific versions of Mattermost.
How do I fix CVE-2025-32093?
To fix CVE-2025-32093, upgrade to Mattermost versions 10.5.2 or higher, 10.4.4 or higher, or 9.11.10 or higher.
What are the consequences of CVE-2025-32093?
CVE-2025-32093 allows users with "Edit Other Users" permission to make unauthorized changes to other system admins.
Which versions are affected by CVE-2025-32093?
CVE-2025-32093 affects Mattermost versions 10.5.x up to 10.5.1, 10.4.x up to 10.4.3, and 9.11.x up to 9.11.9.
Who can exploit CVE-2025-32093?
Users with delegated granular administration rights and the "Edit Other Users" permission can exploit CVE-2025-32093.
- agent/remedy
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/references
- agent/source
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-cve
- collector/github-advisory
- source/GitHub
- alias/GHSA-322v-vh2g-qvpv
- alias/CVE-2025-32093
- agent/tags
- collector/github-advisory-latest
- vendor/mattermost
- canonical/mattermost
- package-manager/go