FlawAtlas
Search the atlas
CVE-2025-2570 Low

Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

Exploit probability 0.3%
Published May 23, 2025
Required by Not available
Last source change March 3, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

43 explicit affected versions

Go github.com/mattermost/mattermost-server
Go github.com/mattermost/mattermost-server/v5
Go github.com/mattermost/mattermost-server/v6
Go github.com/mattermost/mattermost/server/v8
Go github.com/mattermost/mattermost/server/v8

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities GO-2025-3694

Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

View original source
Open Source Vulnerabilities GHSA-fpff-wj6m-grvr

Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

View original source
Open Source Vulnerabilities CVE-2025-2570

Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have access to `ExperimentalSettings` which allows a System Manager to access `ExperimentSettings` when `RestrictSystemAdmin` is true via System Console.

View original source

05 / REFERENCES

Further evidence