CVE-2025-22449: 
Chainguard vulnerability analysis and mitigation

Mattermost versions 9.11.x <= 9.11.5 contain a vulnerability where team admins can bypass invite permissions. The vulnerability was discovered and disclosed on January 9, 2025, affecting the access control functionality in Mattermost's team management system (NVD, Red Hat).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863). It allows team admins to circumvent invite permissions by updating the 'allowopeninvite' field to make their team public, despite not having the proper permissions to invite users. The vulnerability has been assigned a CVSS v3.1 base score of 3.8 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N (NVD).

The vulnerability allows team admins to bypass intended access restrictions and invite users to their team without proper authorization. This could lead to unauthorized access to team resources and potential violation of organizational access control policies (Red Hat).

Organizations using affected versions of Mattermost (9.11.x <= 9.11.5) should upgrade to version 9.11.6 or later which contains the security fix (Mattermost Security).