PT-2025-46948 · Mattermost · Teams (Msteams) Plugin+1

Juho Forsén · Published 2025-10-15 · Updated 2025-11-20 · CVE-2025-55073

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.11 Mattermost versions 10.11.x through 10.11.3 Mattermost versions 10.12.x through 10.12.0

Description The Mattermost application does not properly validate the relationship between a post being updated and the Microsoft Teams (MSTeams) plugin OAuth flow. This allows an attacker to modify any post by using a specially crafted MSTeams plugin OAuth redirect URL. The issue involves a failure to validate the connection between the post update and the OAuth process.

Recommendations Update Mattermost to a version later than 10.5.11. Update Mattermost to a version later than 10.11.3. Update Mattermost to a version later than 10.12.0.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

BDU:2025-16014

CVE-2025-55073

GHSA-FF85-QW3H-G9VP

GO-2025-4129

Affected Products

Mattermost

Teams (Msteams) Plugin

References · 18

• https://osv.dev/vulnerability/GHSA-ff85-qw3h-g9vp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55073 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16014 · Security Note
• https://osv.dev/vulnerability/GO-2025-4129 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55073 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/a41db04d2746ab549d056db4ede4cd803f64989c · Note
• https://github.com/mattermost/mattermost/commit/375ce229f4923205394d8f27925372b2cbf28130 · Note
• https://github.com/mattermost/mattermost/commit/e47349ea0fc072ee1dfb196d9bb1c8fd1a589224 · Note
• https://github.com/mattermost/mattermost/commit/b822cea06bf5683a176e2c92711241bd29cd9389 · Note
• https://github.com/mattermost/mattermost/commit/6c288aa62bb3343183ec1d0a06360d14aa0193e9 · Note
• https://twitter.com/dailycve/status/1991338731987456300 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1989261172810391886 · Twitter Post
• https://t.me/CVEtracker/37323 · Telegram Post