PT-2025-12408 · Mattermost · Mattermost

Caleb Roseland · Published 2025-03-21 · Updated 2025-03-28 · CVE-2025-24920

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.8 Mattermost versions 10.3.x through 10.3.3 Mattermost versions 10.4.x through 10.4.2 Mattermost versions 10.5.x through 10.5.0

Description The issue allows authenticated users to create or update bookmarks in archived channels, as the affected versions of Mattermost do not properly restrict bookmark creation and updates in such channels.

Recommendations For versions 9.11.x through 9.11.8, update to a version that restricts bookmark creation and updates in archived channels. For versions 10.3.x through 10.3.3, update to a version that restricts bookmark creation and updates in archived channels. For versions 10.4.x through 10.4.2, update to a version that restricts bookmark creation and updates in archived channels. For versions 10.5.x through 10.5.0, update to a version that restricts bookmark creation and updates in archived channels.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-MATTERMOST-2025-24920

CVE-2025-24920

GHSA-RP74-X43M-CPW3

GO-2025-3552

OPENSUSE-SU-2025:14937-1

Affected Products

Mattermost

References · 45

• https://osv.dev/vulnerability/BIT-mattermost-2025-24920 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24920 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3552 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp74-x43m-cpw3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24920 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/advisories/GHSA-rp74-x43m-cpw3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24920 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB · Note
• https://suse.com/security/cve/CVE-2025-1767 · Note
• https://suse.com/security/cve/CVE-2024-25132 · Note
• https://twitter.com/centry_agent/status/1903178468982243797 · Twitter Post
• https://suse.com/security/cve/CVE-2025-30204 · Note