CVE-2025-20033
mediumpriority · track · 26EPSS 0.006 · 49 %ileDEEUUSEPSS · scored 2026-10-27
Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedgovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedgovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (29)
Products and version ranges known to be affected.
- mattermost mattermost server10.0.0 → 10.0.4nvdUScpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
- mattermost mattermost server10.1.0 → 10.1.4nvdUScpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
- mattermost mattermost server10.2.0 → 10.2.1nvdUScpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
- mattermost mattermost server9.11.0 → 9.11.6nvdUScpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
- Go github.com/mattermost/mattermost-server10.0.0+incompatible → 10.0.4+incompatibleosvUSpkg:golang/github.com/mattermost/mattermost-server
advisories (4)
Vendor and ecosystem advisories describing this.
- SUSE-SU-2025:0297-1Security update for govulncheck-vulndb2025-01-30csaf · suse_csafDE
Security update for govulncheck-vulndb
- WID-SEC-W-2024-3687Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2024-12-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-2549-xh72-qrpmMattermost Improper Validation of Specified Type of Input vulnerability2025-01-09ghsa · osvUS
Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.
- GO-2025-3379Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server2025-01-09vendor · osvUS
Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/mattermost/mattermost-server from v9.11.0 before v9.11.16.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan