PT-2025-46947 · Mattermost · Mattermost

Published 2025-10-15 · Updated 2025-11-17 · CVE-2025-55070

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions prior to 11

Description Mattermost versions before 11 do not enforce multi-factor authentication on WebSocket connections. This allows unauthenticated users to access sensitive information through WebSocket events.

Recommendations Update to a version of Mattermost that is version 11 or later.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

BDU:2025-16015

CVE-2025-55070

GHSA-XPG8-8XPV-948P

GO-2025-4128

Affected Products

Mattermost

References · 13

• https://osv.dev/vulnerability/GO-2025-4128 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55070 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xpg8-8xpv-948p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55070 · Security Note
• https://bdu.fstec.ru/vul/2025-16015 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/7d8b7b5e4a6076b2f7c87606883c417f9a610df5 · Note
• https://twitter.com/VulmonFeeds/status/1989266291555701037 · Twitter Post
• https://github.com/advisories/GHSA-xpg8-8xpv-948p · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55070 · Note
• https://t.me/CVEtracker/37322 · Telegram Post
• https://twitter.com/CVEnew/status/1989261507608424938 · Twitter Post