PT-2025-6788 · Mattermost · Mattermost

Devin Binnie · Published 2025-02-14 · Updated 2025-02-14 · CVE-2025-0503

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.6

Description The issue allows an attacker to infer user IDs and other metadata from deleted direct messages (DMs) if someone had manually marked DMs as deleted in the database. This is possible because the software fails to filter out DMs from the deleted channels endpoint.

Recommendations For Mattermost versions 9.11.x through 9.11.6, consider restricting access to the deleted channels endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-0503

Affected Products

Mattermost

References · 5

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0503 · Security Note
• https://twitter.com/CVEnew/status/1890465540990218699 · Twitter Post
• https://t.me/cvedetector/18134 · Telegram Post