PT-2025-46949 · Mattermost · Mattermost

Published 2025-11-14 · Updated 2025-11-18 · CVE-2025-11794

Positive Technologies · (AI Summary)

CVSS v2.0

6.8

Medium

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.11 Mattermost versions 10.11.x through 10.11.3 Mattermost versions 10.12.x through 10.12.0

Description The software does not properly sanitize user data, potentially allowing system administrators to access password hashes and multi-factor authentication secrets. This access is possible through the 'POST /api/v4/users/{user id}/email/verify/member' API endpoint. The vulnerable parameter is user id.

Recommendations Update Mattermost versions to a version later than 10.5.11. Update Mattermost versions to a version later than 10.11.3. Update Mattermost versions to a version later than 10.12.0.

Exploit

Fix

LPE

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-16012

CVE-2025-11794

GHSA-MQP8-PGG5-7X7M

GO-2025-4130

Affected Products

Mattermost

References · 19

• 🔥 https://advisories.gitlab.com/pkg/golang/github.com/mattermost/mattermost/server/v8/CVE-2025-11794 · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4130 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mqp8-pgg5-7x7m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11794 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11794 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16012 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/e47349ea0fc072ee1dfb196d9bb1c8fd1a589224 · Note
• https://github.com/mattermost/mattermost/commit/b822cea06bf5683a176e2c92711241bd29cd9389 · Note
• https://github.com/mattermost/mattermost/commit/a41db04d2746ab549d056db4ede4cd803f64989c · Note
• https://github.com/mattermost/mattermost/commit/375ce229f4923205394d8f27925372b2cbf28130 · Note
• https://github.com/mattermost/mattermost/commit/6c288aa62bb3343183ec1d0a06360d14aa0193e9 · Note
• https://github.com/advisories/GHSA-mqp8-pgg5-7x7m · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-46949 · Note