PT-2025-37468 · Mattermost · Mattermost

Doyensec · Published 2025-07-31 · Updated 2025-09-22 · CVE-2025-9072

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.0 through 10.5.9 Mattermost versions 10.9.0 through 10.9.4 Mattermost versions 10.10.0 through 10.10.1

Description Mattermost fails to validate the redirect to parameter, potentially allowing an attacker to craft a malicious link. Upon a user authenticating with their SAML provider, their cookies could be posted to a URL controlled by the attacker.

Recommendations Mattermost versions 10.5.0 through 10.5.9: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.9.0 through 10.9.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. Mattermost versions 10.10.0 through 10.10.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-11487

CVE-2025-9072

GHSA-69J8-PRX2-VX98

GO-2025-3958

OPENSUSE-SU-2025:15564-1

SUSE-SU-2025:03289-1

Affected Products

Mattermost

References · 53

• https://nvd.nist.gov/vuln/detail/CVE-2025-9072 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9072 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11487 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15564-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69j8-prx2-vx98 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3958 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/9eebaadf8f720788e99b6997337c8df330271326 · Note
• https://github.com/mattermost/mattermost/commit/13cd76009d31754db46115bddef5287a8a29871a · Note
• https://github.com/mattermost/mattermost/commit/fda403fb6ec41bea8780bff198a26860f105e6e5 · Note
• https://suse.com/security/cve/CVE-2025-8077 · Note
• https://suse.com/security/cve/CVE-2025-53884 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9072 · Note