CVE-2025-22449

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.0 through 9.11.5

Description The issue is related to the failure of Mattermost to enforce invite permissions. This allows team admins, who do not have permission to invite users to their team, to invite users by making their team public and updating the allow open invite field.

Recommendations For Mattermost versions 9.11.0 through 9.11.5, update to version 9.11.6 or later to resolve the issue. As a temporary workaround, consider restricting the ability of team admins to make their teams public until a patch is available. Restrict access to the allow open invite field to minimize the risk of exploitation.