DeutschShown in its original language — a full translation is planned for a future version.
Mattermost Server und Mobile: Mehrere Schwachstellen
view advisory published 2025-10-15
Ein Angreifer kann mehrere Schwachstellen in Mattermost Server und Mobile ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-55074US | low3.5OT elevated | — | ||
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels… | ||||
| CVE-2025-11794US | — | — | ||
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secret… | ||||
| CVE-2025-55073US | medium5.3OT elevated | — | ||
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow whi… | ||||
| CVE-2025-55070US | high7.5OT elevated | — | ||
Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events | ||||
| CVE-2025-11776US | —OT elevated | — | ||
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_i… | ||||
| CVE-2025-59480US | medium6.5 | — | ||
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker… | ||||
| CVE-2025-11777US | medium4.3OT elevated | — | ||
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to ac… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan