Mattermost Server CVE-2025-10545

Requires a valid authenticated guest user account on a Mattermost Server running an affected version (10.5.x through 10.5.10 or 10.11.x through 10.11.2); the guest invokes the /api/v4/channels/{channel_id}/members endpoint to add any team member to a private channel the guest is in. Limiting factors: the guest-account feature must be in use and provisioned (non-guest-enabled deployments are not exposed), the server must be on an unpatched affected version, and impact is confined to unauthorized channel membership changes / low confidentiality exposure with no integrity or availability effect. No user interaction is needed, but prior authentication as a guest is mandatory, which meaningfully narrows the realistic attacker population to insiders or compromised guest credentials.

This is a low-to-moderate priority authorization flaw (CWE-863, Incorrect Authorization), not a high-severity emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable and low-complexity, but it requires an authenticated guest account (PR:L), and the only impact is low confidentiality (C:L) with no integrity or availability effect. EPSS reinforces low real-world urgency at 0.33% (24th percentile), indicating a low modeled probability of exploitation in the next 30 days. There is no CISA KEV listing and no public proof-of-concept referenced, so this is 'no public exploit identified at time of analysis.' All signals are mutually consistent - low CVSS, low EPSS, no KEV, no POC - pointing to a genuinely low-risk issue rather than a high-CVSS-but-low-real-risk mismatch. One note of caution: the input Tag 'Authentication Bypass' is misleading; the vulnerability is a guest-privilege/authorization enforcement gap (broken access control), not a bypass of authentication itself, so teams should not triage this as a credential/login bypass. The only reference provided is a generic Mattermost security-updates landing page rather than a version-specific advisory, so fixed-version confirmation relies on the NVD description text.

A low-privileged guest user who already has an account on an affected Mattermost server (10.5.x ≤ 10.5.10 or 10.11.x ≤ 10.11.2) calls the channel members API to add arbitrary full team members into a private channel the guest controls, contrary to the intended guest restriction. Because the vector is network and low-complexity with no user interaction, the request can be scripted once valid guest credentials exist, though impact is limited to unauthorized channel membership/low confidentiality exposure. No public exploit code is referenced at time of analysis.