What is the CVSS score of CVE-2025-2570?

CVE-2025-2570 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Mattermost Server are affected by CVE-2025-2570?

CVE-2025-2570 is a low-severity vulnerability (CVSS 2.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2025-2570?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Mattermost Server CVE-2025-2570

LOW

Incorrect Authorization (CWE-863)

2025-05-15 responsibledisclosure@mattermost.com

Authentication Bypass Mattermost Server

2.7

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:42 vuln.today

CVE Published

May 15, 2025 - 16:15 nvd

LOW 2.7

DescriptionNVD

Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console.

AnalysisAI

Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console. Affected products include: Mattermost Mattermost Server.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.

CVE-2025-2570 vulnerability details – vuln.today

Back

Mattermost Server CVE-2025-2570

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code