CVE-2025-3913

MEDIUM Year: 2025
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-863
View all →

Vulnerability Description

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint.

Related Vulnerabilities

CVE-2016-10996

MEDIUM
CVSS:5.3(Medium)

The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.

CWE-8632016

CVE-2017-18095

MEDIUM
CVSS:5.3(Medium)

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to a...

CWE-8632017

CVE-2018-1000110

MEDIUM
CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

CWE-8632018

CVE-2018-1000111

MEDIUM
CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network...

CWE-8632018

CVE-2018-1000112

MEDIUM
CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and use...

CWE-8632018

CVE-2018-18819

MEDIUM
CVSS:5.3(Medium)

A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7....

CWE-8632018