3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4128

CVE-2025-4128: Mattermost allows guest users to view information about public teams they are not members of

Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4128

CVE-2025-4128:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250422131222-701ddc896a10	8.0.0-20250422131222-701ddc896a10
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.5	10.5.5
github.com/mattermost/mattermost-server	go	>= 9.11.0, < 9.11.14	9.11.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allowed guest users to view information about public teams they are not members of. This was due to an improper authorization check in the API endpoint /api/v4/teams/{team_id}. The commit patches reveal that the function api4.getTeam in server/channels/api4/team.go is the handler for this endpoint.

The root cause was an insufficient conditional statement for permission checking within api4.getTeam. The original logic effectively bypassed necessary permission checks if a team was flagged as 'public' (open invite and type open). This allowed users, including guests, who were not members of a public team and did not have the PermissionViewTeam for that specific team, to still retrieve the team's details.

The patch addresses this by introducing a more granular permission check. It first determines if a team is public (isPublicTeam) and if the user has direct permission to view the team (hasPermissionViewTeam). The critical fix is a new condition: if isPublicTeam && !hasPermissionViewTeam && !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionListPublicTeams). This ensures that for public teams where the user is not a member (i.e., !hasPermissionViewTeam), the user must possess the broader PermissionListPublicTeams to access the team information. If they don't, access is denied. This change directly mitigates the reported vulnerability by correctly restricting access based on appropriate permissions for public teams.

Therefore, api4.getTeam is the vulnerable function as it contained the flawed logic that was exploited to gain unauthorized access to team information. During exploitation, this function would be present in the runtime profile as it processes the malicious API request.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.