CVE-2025-24866: Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint

April 10, 2025 (updated April 23, 2025)

Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.

References

github.com/advisories/GHSA-xfq9-hh5x-xfq9
github.com/mattermost/mattermost
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-24866
pkg.go.dev/vuln/GO-2025-3604

Code Behaviors & Features

Detect and mitigate CVE-2025-24866 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →