---
id: CVE-2025-3611
aliases:
  - GHSA-86jg-35xj-3vv5
  - GO-2025-3728
title: >-
  Mattermost fails to properly enforce access control restrictions for System
  Manager roles
summary: >-
  Mattermost fails to properly enforce access control restrictions for System
  Manager roles
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
vendor: mattermost
product: github.com/mattermost/mattermost/server/v8
ecosystem: go
affected:
  - 'github.com/mattermost/mattermost/server/v8 >= 10.6.0-rc1, < 10.7.1'
  - 'github.com/mattermost/mattermost/server/v8 >= 10.0.0-rc1, < 10.5.4'
  - 'github.com/mattermost/mattermost/server/v8 >= 9.0.0-rc1, < 9.11.13'
  - >-
    github.com/mattermost/mattermost/server/v8 <
    8.0.0-20250414154356-6f33b721de76
patched:
  - github.com/mattermost/mattermost/server/v8 10.7.1
  - github.com/mattermost/mattermost/server/v8 10.5.4
  - github.com/mattermost/mattermost/server/v8 9.11.13
  - github.com/mattermost/mattermost/server/v8 8.0.0-20250414154356-6f33b721de76
published: '2025-05-30'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-86jg-35xj-3vv5'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-3611'
  - url: >-
      https://github.com/mattermost/mattermost/commit/6f33b721de76b39a7714bfe0d5e9c1306869a3e3
  - url: 'https://github.com/mattermost/mattermost'
  - url: 'https://mattermost.com/security-updates'
tags:
  - osv
  - go
epss: 0.00224
epssPercentile: 0.11576
ingestedAt: '2026-08-07T19:14:16.313Z'
---

## Overview

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console.

## Affected packages

- `github.com/mattermost/mattermost/server/v8 >= 10.6.0-rc1, < 10.7.1`
- `github.com/mattermost/mattermost/server/v8 >= 10.0.0-rc1, < 10.5.4`
- `github.com/mattermost/mattermost/server/v8 >= 9.0.0-rc1, < 9.11.13`
- `github.com/mattermost/mattermost/server/v8 < 8.0.0-20250414154356-6f33b721de76`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost/server/v8 10.7.1`
- `github.com/mattermost/mattermost/server/v8 10.5.4`
- `github.com/mattermost/mattermost/server/v8 9.11.13`
- `github.com/mattermost/mattermost/server/v8 8.0.0-20250414154356-6f33b721de76`