CVE-2025-3227
Unauthorized channel member management through playbook runs
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Unauthorized channel member management through playbook runs
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
- Record
CVE-2025-3227- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2025-18758
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
- Record
EUVD-2025-18758- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qwwm-c582-82rx
Mattermost allows unauthorized channel member management through playbook runs
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
- Record
GHSA-qwwm-c582-82rx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
- Record
CVE-2025-3227- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Unauthorized channel member management through playbook runs
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
- Record
CVE-2025-3227- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVGHSA-qwwm-c582-82rx
Mattermost allows unauthorized channel member management through playbook runs
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
- Record
GHSA-qwwm-c582-82rx- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGO-2025-3772 No score
Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server
Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server
- Record
GO-2025-3772- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score
govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost-serverGo |
before 0.0.0-20250520060012-d0380305ef7a | 0.0.0-20250520060012-d0380305ef7a |
github.com/mattermost/mattermost/server/v8Go |
before 8.0.0-20250520060012-d0380305ef7a | 8.0.0-20250520060012-d0380305ef7a |
github.com/mattermost/mattermost/server/v8Go |
10.5.0 to 10.5.5 | 10.5.6 |
github.com/mattermost/mattermost/server/v8Go |
9.11.0 to 9.11.15 | 9.11.16 |
github.com/mattermost/mattermost/server/v8Go |
10.8.0 to 10.8.0 | 10.8.1 |
github.com/mattermost/mattermost/server/v8Go |
10.7.0 to 10.7.2 | 10.7.3 |
github.com/mattermost/mattermost/server/v8Go |
10.6.0 to 10.6.5 | 10.6.6 |
github.com/mattermost/mattermost/server/v8Go |
10.5.0 up to 10.5.6 | 10.5.6 |
github.com/mattermost/mattermost/server/v8Go |
9.11.0 up to 9.11.16 | 9.11.16 |
github.com/mattermost/mattermost/server/v8Go |
10.8.0 up to 10.8.1 | 10.8.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go |
10.7.0 up to 10.7.3 | 10.7.3 |
github.com/mattermost/mattermost/server/v8Go |
10.6.0 up to 10.6.6 | 10.6.6 |
github.com/mattermost/mattermost-serverGo |
before 0.0.0-20250520060012-d0380305ef7a, 9.11.0+incompatible up to 9.11.16+incompatible, 10.5.0+incompatible up to 10.5.6+incompatible, 10.6.0+incompatible up to 10.6.6+incompatible, 10.7.0+incompatible up to 10.7.3+incompatible, 10.8.0+incompatible up to 10.8.1+incompatible | 0.0.0-20250520060012-d0380305ef7a9.11.16+incompatible10.5.6+incompatible10.6.6+incompatible10.7.3+incompatible10.8.1+incompatible |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 0.0.20250730T213748-1.1 | 0.0.20250730T213748-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3227 is a medium vulnerability (CVSS 4.3) in Mattermost, published June 20, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in github.com/mattermost/mattermost-server 0.0.0-20250520060012-d0380305ef7a.
References
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-3227
github.com/advisories/GHSA-qwwm-c582-82rx
suse.com/security/cve/CVE-2024-44905
Show 55 moreShow less