Communication and Collaboration

In Mattermost versions 11.0.x ≤ 11.0.4, 10.12.x ≤ 10.12.2, and 10.11.x ≤ 10.11.6 a medium severity vulnerability CVE-2025-12689 was detected. This vulnerability allows attackers to crash the Mattermost Calls plugin by sending malformed WebSocket requests that are not properly validated for UTF-8 encoding, resulting in a denial-of-service condition. To address this issue, users should upgrade Mattermost to versions 11.1.0, 11.0.5, 10.12.3, 10.11.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12689.

In Mattermost Desktop App versions prior to 6.0.0 a low severity vulnerability CVE-2025-13326 was detected. This vulnerability allows attackers to inherit macOS Transparency, Consent, and Control (TCC) permissions by copying the application binary to a temporary folder due to the Hardened Runtime not being enabled when the app is packaged for the Mac App Store. To address this issue, users should upgrade Mattermost Desktop App to version 6.0.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13326.

In Mattermost Desktop App versions below 6.0.0 a low severity vulnerability CVE-2025-13321 was detected. This vulnerability allows attackers with access to a user’s system to gain access to potentially sensitive information by reading unsanitized application logs and data not cleared upon server deletion. To address this issue, users should upgrade Mattermost Desktop App to version 6.0.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13321.

In Mattermost versions 10.11.x up to and including 10.11. a low severity vulnerability CVE-2025-62690 was detected. This vulnerability allows attackers to redirect victims to malicious websites by abusing improper validation of redirect URLs on the /error page through a crafted link opened in a new tab. To address this issue, users should upgrade Mattermost to version 11.1.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62690.

In Mattermost versions 11.0.x up to and including 11.0.4, 10.12.x up to and including 10.12.2, 10.11.x up to and including 10.11.6, and Mattermost Calls versions up to and including 1.10.0 a medium severity vulnerability CVE-2025-62190 was detected. This vulnerability allows authenticated attackers to initiate calls and inject messages into channels or direct messages by exploiting missing CSRF protection on the Calls widget page via a malicious webpage or crafted link. To address this issue, users should upgrade Mattermost to versions 11.1.0, 11.0.5, 10.12.3, 10.11.7 or Mattermost Calls plugin to version 1.11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62190.

In Mattermost versions 10.11.x up to and including 10.11.6 and Mattermost GitHub plugin versions up to and including 2.4.0 a low severity vulnerability CVE-2025-13352 was detected. This vulnerability allows attackers to hijack the GitHub reaction forwarding feature by exploiting insufficient validation of the plugin bot identity, causing users to unknowingly add reactions to arbitrary GitHub objects via crafted notification posts. To address this issue, users should upgrade Mattermost to versions 11.1.0, 10.11.5 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13352.

In Mattermost versions 10.11.x up to 10.11.4 and 10.5.x up to 10.5.12 a low severity vulnerability CVE-2025-13870 was detected. This vulnerability allows authenticated users to bypass permission checks when accessing board files or subscribing to blocks, enabling access to files and subscriptions from boards they should not have access to. To address this issue, users should upgrade Mattermost to versions 10.11.5 or 10.5.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13870.

In Mattermost versions 11.0.x up to 11.0.2, 10.12.x up to 10.12.1, 10.11.x up to 10.11.4 and 10.5.x up to 10.5.12 a medium severity vulnerability CVE-2025-12756 was detected. This vulnerability allows authenticated users with the editor role to bypass permission checks and delete comments created by other users in Boards. To address this issue, users should upgrade Mattermost to versions 11.0.3 or later, 10.12.2 or later, 10.11.5 or later, and 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12756.

In Mattermost versions 10.11.x through 10.11.4 and 10.5.x through 10.5.12 a low severity vulnerability CVE-2025-13870 was identified. This vulnerability allows authenticated users to bypass permission validation when accessing files and subscribing to blocks in Boards. As a result, users can access files and subscribe to blocks on other boards they do not have permission to view. To address this issue, users should upgrade Mattermost to versions 10.11.5, 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13870.