Improper Channel Management in Mattermost by Mattermost

CVE-2025-46702

What is CVE-2025-46702?

Several versions of Mattermost exhibit improper enforcement of channel member management permissions. Specifically, when adding participants to playbook runs, authenticated users with member-level permissions can circumvent system admin restrictions. This flaw allows them to add or remove users from private channels despite the 'Manage Members' permission being revoked. As a result, unauthorized access to sensitive content within channels becomes possible, enabling even guest users to acquire channel management capabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References