PT-2025-48544 · Mattermost · Mattermost

Daynight · Published 2025-10-28 · Updated 2025-12-15 · CVE-2025-12756

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.0.0 through 11.0.2 Mattermost versions 10.5.0 through 10.5.12 Mattermost versions 10.11.0 through 10.11.4 Mattermost versions 10.12.0 through 10.12.1

Description The software does not properly check user permissions when deleting comments within the Boards feature. This allows a user with editor role privileges to delete comments created by other users. The affected functionality involves the deletion of comments in Boards.

Recommendations Update Mattermost to a version later than 11.0.2. Update Mattermost to a version later than 10.12.1. Update Mattermost to a version later than 10.11.4. Update Mattermost to a version later than 10.5.12.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-15206

CVE-2025-12756

GHSA-P6GJ-JC38-X2M7

GO-2025-4172

SUSE-SU-2025:4395-1

Affected Products

Mattermost

References · 48

• https://osv.dev/vulnerability/GO-2025-4172 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15206 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12756 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-18871 · Note
• https://suse.com/security/cve/CVE-2025-61729 · Note
• https://suse.com/security/cve/CVE-2025-64751 · Note
• https://suse.com/security/cve/CVE-2017-18883 · Note
• https://suse.com/security/cve/CVE-2018-21258 · Note
• https://suse.com/security/cve/CVE-2025-65111 · Note
• https://suse.com/security/cve/CVE-2025-44005 · Note
• https://suse.com/security/cve/CVE-2025-64761 · Note
• https://suse.com/security/cve/CVE-2025-13870 · Note