What’s Vulnerable › Vulnerabilities
CVE-2025-3227: Unauthorized channel member management through playbook runs
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-20 · updated 2026-06-17
- Weakness: CWE-863
Description
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
Affected products
- Mattermost: from 9.11.0 before 9.11.16; from 10.5.0 before 10.5.6; from 10.6.0 before 10.6.6; from 10.7.0 before 10.7.3; 10.8.0, 10.8.0-rc1, 10.8.0-rc2, 10.8.0-rc3 — fixed in 10.5.6, 10.6.6, 10.7.3, 9.11.16
How to fix
Upgrade to a fixed version: Mattermost 10.5.6, 10.6.6, 10.7.3, 9.11.16. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-3227 or the next vulnerability affects your stack