4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3446

CVE-2025-3446: Mattermost Fails to Validate Team Invite Permissions

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to check the correct permissions which allows authenticated users who only have permission to invite non-guest users to a team to add guest users to that team via the API to add a single user to a team.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3446

CVE-2025-3446:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.6.0, <= 10.6.1	10.6.2
github.com/mattermost/mattermost/server/v8	go	>= 10.5.0, <= 10.5.2	10.5.3
github.com/mattermost/mattermost/server/v8	go	>= 10.4.0, <= 10.4.4	10.4.5
github.com/mattermost/mattermost/server/v8	go	>= 9.11.0, <= 9.11.11	9.11.12
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250415054241-76ab3867b785	8.0.0-20250415054241-76ab3867b785

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description clearly states that Mattermost failed to validate permissions for team invites, specifically allowing users without guest invitation permissions to add guests via the API for adding a single user. I started by examining the provided version ranges and patch information. The commit 76ab3867b785 associated with v10.6.2 was initially investigated but found to be related to UI components, not the server-side API logic described.

I then compared the tags v10.6.1 (last vulnerable) and v10.6.2 (first patched) for the mattermost/mattermost repository. Among the commits between these tags, a4a6b40e7b500ba3958966b84b9864d49c3e5c11 stood out due to its message: "MM-63350 Add tests for inviting guest users to teams".

Fetching the details of this commit revealed modifications to server/channels/api4/team.go, specifically within the addTeamMember function. This function is the handler for the API endpoint that adds a single user to a team. The patch introduced a new block of code that explicitly checks if the inviting user has model.PermissionInviteGuest. If they do not, and the user being added is identified as a guest (user.IsGuest()), a permission error is returned. This directly addresses the described vulnerability.

The commit was a cherry-pick of 3b9f9b209a28b584e52f91522f60c0d58325f1ab, which contained the same relevant code changes. The added test functions, TestAddTeamMemberGuestPermissions and TestAddTeamMembersGuestPermissions, further corroborate that the fix is centered around guest invitation permissions for team membership APIs. Although tests for addTeamMembers (batch addition) were also added, the vulnerability description specifically points to the "API to add a single user to a team," making addTeamMember the primary vulnerable function identified from the patch.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.