Team Invitation Information Exposure in Mattermost Versions
CVE-2025-47870

4.3MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
21 August 2025

What is CVE-2025-47870?

The Mattermost platform is susceptible to a security flaw in certain versions that results from the failure to properly sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint. This oversight allows a team administrator, who does not possess member invite privileges, to access the sensitive team invite ID, potentially leading to unauthorized access or manipulation of team membership.

Affected Version(s)

Mattermost 10.8.0 <= 10.8.3

Mattermost 10.5.0 <= 10.5.8

Mattermost 9.11.0 <= 9.11.17

References

https://mattermost.com/security-updates

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

omarAhmed1
.