CVE-2025-32093 - Vulnerability Details

Link	Providers
https://mattermost.com/security-updates

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation.
Title		Syatem admin profile modification by delegated granular administration role
Weaknesses		CWE-863
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-32093", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2025-04-08T07:50:19.639Z", "datePublished": "2025-04-14T06:57:54.208Z", "dateUpdated": "2025-04-14T13:58:29.741Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "10.5.1", "status": "affected", "version": "10.5.0", "versionType": "semver"}, {"lessThanOrEqual": "10.4.3", "status": "affected", "version": "10.4.0", "versionType": "semver"}, {"lessThanOrEqual": "9.11.9", "status": "affected", "version": "9.11.0", "versionType": "semver"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.5.2"}, {"status": "unaffected", "version": "10.4.4"}, {"status": "unaffected", "version": "9.11.10"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bob10x1"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Mattermost versions 10.5.x &lt;= 10.5.1, 10.4.x &lt;= 10.4.3, 9.11.x &lt;= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the \"Edit Other Users\" permission to perform unauthorized modifications to system administrators via improper permission validation.</p>"}], "value": "Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the \"Edit Other Users\" permission to perform unauthorized modifications to system administrators via improper permission validation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-04-14T06:57:54.208Z"}, "references": [{"url": "https://mattermost.com/security-updates"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher.</p>"}], "value": "Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher."}], "source": {"advisory": "MMSA-2025-00447", "defect": ["https://mattermost.atlassian.net/browse/MM-62686"], "discovery": "EXTERNAL"}, "title": "Syatem admin profile modification by delegated granular administration role", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-14T13:58:05.225412Z", "id": "CVE-2025-32093", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T13:58:29.741Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-32093 (string)

assignerOrgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

state : PUBLISHED (string)

assignerShortName : Mattermost (string)

dateReserved : 2025-04-08T07:50:19.639Z (string)

datePublished : 2025-04-14T06:57:54.208Z (string)

dateUpdated : 2025-04-14T13:58:29.741Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mattermost (string)

vendor : Mattermost (string)

versions : [ »

0 : { »

lessThanOrEqual : 10.5.1 (string)

status : affected (string)

version : 10.5.0 (string)

versionType : semver (string)

}

1 : { »

lessThanOrEqual : 10.4.3 (string)

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

}

2 : { »

lessThanOrEqual : 9.11.9 (string)

status : affected (string)

version : 9.11.0 (string)

versionType : semver (string)

}

3 : { »

status : unaffected (string)

version : 10.6.0 (string)

}

4 : { »

status : unaffected (string)

version : 10.5.2 (string)

}

5 : { »

status : unaffected (string)

version : 10.4.4 (string)

}

6 : { »

status : unaffected (string)

version : 9.11.10 (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Bob10x1 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. (string)

}

]

value : Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

shortName : Mattermost (string)

dateUpdated : 2025-04-14T06:57:54.208Z (string)

}

references : [ »

0 : { »

url : https://mattermost.com/security-updates (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. (string)

}

]

value : Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. (string)

}

]

source : { »

advisory : MMSA-2025-00447 (string)

defect : [ »

0 : https://mattermost.atlassian.net/browse/MM-62686 (string)

]

discovery : EXTERNAL (string)

}

title : Syatem admin profile modification by delegated granular administration role (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-14T13:58:05.225412Z (string)

id : CVE-2025-32093 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-14T13:58:29.741Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-32093", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-14T13:58:05.225412Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-14T13:58:11.221Z"}}], "cna": {"title": "Syatem admin profile modification by delegated granular administration role", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-62686"], "advisory": "MMSA-2025-00447", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bob10x1"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.1"}, {"status": "affected", "version": "10.4.0", "versionType": "semver", "lessThanOrEqual": "10.4.3"}, {"status": "affected", "version": "9.11.0", "versionType": "semver", "lessThanOrEqual": "9.11.9"}, {"status": "unaffected", "version": "10.6.0"}, {"status": "unaffected", "version": "10.5.2"}, {"status": "unaffected", "version": "10.4.4"}, {"status": "unaffected", "version": "9.11.10"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher.", "supportingMedia": [{"type": "text/html", "value": "<p>Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher.</p>", "base64": false}]}], "references": [{"url": "https://mattermost.com/security-updates"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the \"Edit Other Users\" permission to perform unauthorized modifications to system administrators via improper permission validation.", "supportingMedia": [{"type": "text/html", "value": "<p>Mattermost versions 10.5.x &lt;= 10.5.1, 10.4.x &lt;= 10.4.3, 9.11.x &lt;= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the \"Edit Other Users\" permission to perform unauthorized modifications to system administrators via improper permission validation.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2025-04-14T06:57:54.208Z"}}}, "cveMetadata": {"cveId": "CVE-2025-32093", "state": "PUBLISHED", "dateUpdated": "2025-04-14T13:58:29.741Z", "dateReserved": "2025-04-08T07:50:19.639Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2025-04-14T06:57:54.208Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-32093 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-14T13:58:05.225412Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-14T13:58:11.221Z (string)

}

]

cna : { »

title : Syatem admin profile modification by delegated granular administration role (string)

source : { »

defect : [ »

0 : https://mattermost.atlassian.net/browse/MM-62686 (string)

]

advisory : MMSA-2025-00447 (string)

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Bob10x1 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.7 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : LOW (string)

privilegesRequired : HIGH (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Mattermost (string)

product : Mattermost (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.5.0 (string)

versionType : semver (string)

lessThanOrEqual : 10.5.1 (string)

}

1 : { »

status : affected (string)

version : 10.4.0 (string)

versionType : semver (string)

lessThanOrEqual : 10.4.3 (string)

}

2 : { »

status : affected (string)

version : 9.11.0 (string)

versionType : semver (string)

lessThanOrEqual : 9.11.9 (string)

}

3 : { »

status : unaffected (string)

version : 10.6.0 (string)

}

4 : { »

status : unaffected (string)

version : 10.5.2 (string)

}

5 : { »

status : unaffected (string)

version : 10.4.4 (string)

}

6 : { »

status : unaffected (string)

version : 9.11.10 (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Update Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. (string)

base64 : false (boolean)

}

]

}

]

references : [ »

0 : { »

url : https://mattermost.com/security-updates (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

shortName : Mattermost (string)

dateUpdated : 2025-04-14T06:57:54.208Z (string)

}

cveMetadata : { »

cveId : CVE-2025-32093 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-14T13:58:29.741Z (string)

dateReserved : 2025-04-08T07:50:19.639Z (string)

assignerOrgId : 9302f53e-dde5-4bf3-b2f2-a83f91ac0eee (string)

datePublished : 2025-04-14T06:57:54.208Z (string)

assignerShortName : Mattermost (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the \"Edit Other Users\" permission to perform unauthorized modifications to system administrators via improper permission validation."}, {"lang": "es", "value": "Las versiones de Mattermost 10.5.x &lt;= 10.5.1, 10.4.x &lt;= 10.4.3, 9.11.x &lt;= 9.11.9 no restringen ciertas operaciones de los administradores del sistema solo a otros administradores del sistema, lo que permite que los usuarios de administraci\u00f3n granular delegados con el permiso \"Editar otros usuarios\" realicen modificaciones no autorizadas en los administradores del sistema a trav\u00e9s de una validaci\u00f3n de permisos incorrecta."}], "id": "CVE-2025-32093", "lastModified": "2025-04-15T18:39:27.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}, "published": "2025-04-14T07:15:14.700", "references": [{"source": "responsibledisclosure@mattermost.com", "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. (string)

}

1 : { »

lang : es (string)

value : Las versiones de Mattermost 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 no restringen ciertas operaciones de los administradores del sistema solo a otros administradores del sistema, lo que permite que los usuarios de administración granular delegados con el permiso "Editar otros usuarios" realicen modificaciones no autorizadas en los administradores del sistema a través de una validación de permisos incorrecta. (string)

}

]

id : CVE-2025-32093 (string)

lastModified : 2025-04-15T18:39:27.967 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 3.4 (number)

source : responsibledisclosure@mattermost.com (string)

type : Secondary (string)

}

]

}

published : 2025-04-14T07:15:14.700 (string)

references : [ »

0 : { »

source : responsibledisclosure@mattermost.com (string)

url : https://mattermost.com/security-updates (string)

}

]

sourceIdentifier : responsibledisclosure@mattermost.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : responsibledisclosure@mattermost.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object