CVE-2025-14573 LOW

CVE-2025-14573: Team Admin Bypass of Invite Permissions via allow_open_invite Field

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published February 16, 2026
Last update February 17, 2026
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

Key dates

02Disclosure timeline

February 16, 2026 CVE published
February 17, 2026 Record updated