PT-2025-47329 · Mattermost · Agents Plugin+1

Juho Forsén · Published 2025-11-18 · Updated 2025-12-15 · CVE-2025-55074

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.11 Mattermost versions 10.11.x through 10.11.3

Description The Mattermost application does not properly enforce access permissions within the Agents plugin. This allows other users to determine when users have read channels by accessing channel member objects.

Recommendations Update Mattermost to a version later than 10.5.11. Update Mattermost to a version later than 10.11.3.

Fix

Incorrect Default Permissions

Information Disclosure

Weakness Enumeration

CWE-1426

CWE-276

CWE-200

Related Identifiers

BDU:2025-16017

CVE-2025-55074

GHSA-9HH7-6558-QFP2

GO-2025-4133

SUSE-SU-2025:4395-1

Affected Products

Agents Plugin

Mattermost

References · 55

• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16017 · Security Note
• https://osv.dev/vulnerability/GO-2025-4133 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9hh7-6558-qfp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55074 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55074 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149 · Note
• https://github.com/mattermost/mattermost/commit/d72d437f1567ba0b639b6e4fd73bab06c51baab5 · Note
• https://github.com/mattermost/mattermost/commit/98acefe911dd9de7edf47a7d825dd99f53141a52 · Note
• https://github.com/mattermost/mattermost/pull/33835 · Note
• https://github.com/mattermost/mattermost/pull/33905 · Note
• https://suse.com/security/cve/CVE-2025-60632 · Note
• https://suse.com/security/cve/CVE-2025-66410 · Note