FlawAtlas
Search the atlas
CVE-2025-1472 Moderate

Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server

Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server

Exploit probability 0.2%
Published March 25, 2025
Required by Not available
Last source change March 3, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

26 explicit affected versions

Go github.com/mattermost/mattermost-server
Go github.com/mattermost/mattermost-server/v5
Go github.com/mattermost/mattermost-server/v6
Go github.com/mattermost/mattermost/server/v8
Go github.com/mattermost/mattermost/server/v8
Go github.com/mattermost/mattermost-server

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2025-1472

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

View original source
Open Source Vulnerabilities GO-2025-3534

Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server

View original source
Open Source Vulnerabilities GHSA-fqrq-xmxj-v47x

Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.

View original source

05 / REFERENCES

Further evidence