Channel Member Management Flaw in Mattermost by Mattermost Inc.

CVE-2025-3227

What is CVE-2025-3227?

In various versions of Mattermost, a permissions management flaw allows authenticated users without the 'Manage Channel Members' permissions to manipulate channel memberships during playbook run executions. This vulnerability arises when users can add or remove members in both public and private channels, posing a security risk by undermining established access controls. It is critical for organizations using affected Mattermost versions to evaluate their deployments and apply the necessary updates to safeguard their channels.

References