CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2025-27715

Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 14.8%

CVSS Severity

CVSS v3 Score 3.3

References

https://mattermost.com/security-updates

Products affected by CVE-2025-27715

Mattermost » Mattermost Server » Version: 9.11.0

cpe:2.3:a:mattermost:mattermost_server:9.11.0
Mattermost » Mattermost Server » Version: 9.11.1

cpe:2.3:a:mattermost:mattermost_server:9.11.1
Mattermost » Mattermost Server » Version: 9.11.2

cpe:2.3:a:mattermost:mattermost_server:9.11.2
Mattermost » Mattermost Server » Version: 9.11.3

cpe:2.3:a:mattermost:mattermost_server:9.11.3
Mattermost » Mattermost Server » Version: 9.11.4

cpe:2.3:a:mattermost:mattermost_server:9.11.4
Mattermost » Mattermost Server » Version: 9.11.5

cpe:2.3:a:mattermost:mattermost_server:9.11.5
Mattermost » Mattermost Server » Version: 9.11.6

cpe:2.3:a:mattermost:mattermost_server:9.11.6
Mattermost » Mattermost Server » Version: 9.11.7

cpe:2.3:a:mattermost:mattermost_server:9.11.7
Mattermost » Mattermost Server » Version: 9.11.8

cpe:2.3:a:mattermost:mattermost_server:9.11.8

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2025-27715

Products

Pricing

Contact Us