Authorization Flaw in Mattermost Affects Team Admin Roles

CVE-2025-53971

What is CVE-2025-53971?

Certain versions of Mattermost contain a vulnerability that compromises authorization checks for modifying team roles. This issue specifically enables Team Admins to downgrade Team Members to Guests through the API endpoint. Proper validation is not enforced, potentially leading to unintended changes in user roles and privileges, thereby jeopardizing team security. It is critical for organizations utilizing affected Mattermost versions to update promptly and safeguard against unauthorized role modifications.

References