Improper Channel Management in Mattermost by Mattermost

CVE-2025-46702

What is CVE-2025-46702?

Several versions of Mattermost exhibit improper enforcement of channel member management permissions. Specifically, when adding participants to playbook runs, authenticated users with member-level permissions can circumvent system admin restrictions. This flaw allows them to add or remove users from private channels despite the 'Manage Members' permission being revoked. As a result, unauthorized access to sensitive content within channels becomes possible, enabling even guest users to acquire channel management capabilities.

References