Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0263

NIXPKGS-2026-0263
published on 17 Feb 2026
Permalink CVE-2025-14573
updated 4 days, 1 hour ago by @LeSuisse Activity log
  • Created automatic suggestion 4 days, 17 hours ago
  • @LeSuisse removed
    4 packages
    • mattermost-desktop
    • python312Packages.mattermostdriver
    • python313Packages.mattermostdriver
    • python314Packages.mattermostdriver
    4 days, 3 hours ago
  • @LeSuisse removed
    5 maintainers
    • @fsagbuya
    • @Kranzes
    • @numinit
    • @mgdelacroix
    • @ryantm
    4 days, 1 hour ago
  • @LeSuisse accepted 4 days, 1 hour ago
  • @LeSuisse published on GitHub 4 days, 1 hour ago
Team Admin Bypass of Invite Permissions via allow_open_invite Field

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

Affected products

Mattermost
  • =<10.11.9
  • ==11.3.0
  • ==10.11.10

Matching in nixpkgs

Package maintainers

Ignored maintainers (5) 
Fixed in:
* Unstable: https://github.com/NixOS/nixpkgs/pull/480349 / https://github.com/NixOS/nixpkgs/pull/478724
* 25.11: https://github.com/NixOS/nixpkgs/pull/480574 / https://github.com/NixOS/nixpkgs/pull/479561