CVE-2025-10545: Mattermost Server Auth Bypass Vulnerability

CVE-2025-10545 Overview

CVE-2025-10545 is an authorization flaw in Mattermost Server that lets guest users add arbitrary team members to their private channels. The vulnerability affects Mattermost versions 10.5.x up to 10.5.10 and 10.11.x up to 10.11.2. The root cause is improper validation of guest user permissions in the /api/v4/channels/{channel_id}/members endpoint. Guest accounts are intended to have restricted membership management privileges, but this flaw permits them to invite users beyond their allowed scope. The issue is categorized under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated guest users can add any team member to their private channels, exposing conversations and files to unintended recipients.

Affected Products

Mattermost Server 10.5.x through 10.5.10
Mattermost Server 10.11.x through 10.11.2
Deployments relying on guest account isolation for private channels

Discovery Timeline

2025-10-16 - CVE-2025-10545 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-10545

Vulnerability Analysis

Mattermost distinguishes between full team members and guest users. Guest accounts should only interact with resources explicitly shared with them. The /api/v4/channels/{channel_id}/members endpoint accepts POST requests to add users to a channel. In the affected versions, the server checks that the caller is a channel member but does not verify that a guest caller may invite the target user.

As a result, a guest with access to a private channel can enumerate team member IDs and add them to that channel. The impact is limited to confidentiality within the affected workspace. Integrity and availability are not directly affected, since guests still cannot modify server settings or delete data through this path.

Root Cause

The root cause is missing role-based checks in the channel membership handler. Guest permission validation is not enforced consistently before executing the add-member operation. This is an authorization gap rather than an authentication or input validation flaw.

Attack Vector

Exploitation requires an authenticated guest account and network access to the Mattermost API. The attacker sends a crafted POST request to /api/v4/channels/{channel_id}/members with a target user ID. No user interaction is required from the victim, and no elevated privileges are needed beyond the guest role.

See the Mattermost Security Updates advisory for vendor technical details.

Detection Methods for CVE-2025-10545

Indicators of Compromise

POST requests to /api/v4/channels/{channel_id}/members originating from accounts flagged with the guest role
Unexpected additions of full team members to channels that only contain guest participants
Audit log entries showing channel membership changes initiated by users with system_guest role

Detection Strategies

Review Mattermost audit logs for channel.addMember actions where the requester role is guest
Correlate API access logs with user role assignments to surface anomalous membership changes
Alert on any guest-initiated membership operation targeting non-guest user IDs

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized logging platform for continuous review
Track baselines for channel membership changes per user role and alert on deviations
Monitor version strings returned by /api/v4/system/ping to confirm all instances run patched releases

How to Mitigate CVE-2025-10545

Immediate Actions Required

Upgrade Mattermost Server to a version above 10.5.10 in the 10.5.x branch or above 10.11.2 in the 10.11.x branch
Audit private channels for unexpected members added by guest accounts and remove unauthorized users
Review guest account provisioning and disable inactive guest accounts

Patch Information

Mattermost has released fixed versions addressing this authorization gap. Refer to the Mattermost Security Updates page for the specific patched release corresponding to your deployment branch. Apply the update through your standard Mattermost upgrade process and verify the version after restart.

Workarounds

Restrict guest user creation until patched versions are deployed
Limit private channel usage for guests to channels containing only intended participants
Enforce administrator review of channel membership changes through workflow controls where feasible

bash

# Verify Mattermost server version after upgrade
curl -s https://<mattermost-host>/api/v4/config/client?format=old | grep Version