CVE-2025-3913: Mattermost improperly allows team administrators to modify team invites

The vulnerability (CVE-2025-3913) description states that Mattermost failed to properly validate permissions when changing team privacy settings, specifically allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint. The provided commit 02c76784380acb6802601bd24c205553b9a5a1be directly addresses this issue. The diff for server/channels/api4/team.go shows that a permission check for model.PermissionInviteUser was added to the updateTeamPrivacy function. This function is the handler for the aforementioned API endpoint. The absence of this check before the patch is the root cause of the vulnerability, making updateTeamPrivacy the vulnerable function. The exploit would involve a team administrator, who lacks the 'invite_user' permission, making a request to this endpoint to change team privacy in a way that regenerates the invite ID, thereby bypassing the intended permission model.