CVE-2025-32093: Mattermost Fails to Restrict Certain Operations on System Admins
4.7
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost-server | go | >= 10.5.0, < 10.5.2 | 10.5.2 |
| github.com/mattermost/mattermost-server | go | >= 10.4.0, < 10.4.4 | 10.4.4 |
| github.com/mattermost/mattermost-server | go | >= 9.11.0, < 9.11.10 | 9.11.10 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.5.0, < 10.5.2 | 10.5.2 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.4.0, < 10.4.4 | 10.4.4 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.11.0, < 9.11.10 | 9.11.10 |
| github.com/mattermost/mattermost/server/v8 | go | < 8.0.0-20250227102013-aa4623a93199 | 8.0.0-20250227102013-aa4623a93199 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability describes an improper permission validation allowing users with "Edit Other Users" permission to modify system administrators. The provided commit aa4623a9319943d9f54383b22b55e7d06a324e20 directly addresses this by modifying the SessionHasPermissionToUser function in server/channels/app/authorization.go.
The patch introduces logic to explicitly check if the target user (userID) is a system admin. If the target is a system admin, the function now returns false unless the session holder has model.PermissionManageSystem or is unrestricted. This directly fixes the described flaw where a user with only model.PermissionEditOtherUsers could previously modify a system admin. Therefore, app.SessionHasPermissionToUser is the function where the improper permission validation occurred.