Communication and Collaboration

In Mattermost versions 10.11.x up to 10.11.4 and 10.5.x up to 10.5.12 a low severity vulnerability CVE-2025-13870 was detected. This vulnerability allows authenticated users to bypass permission checks when accessing board files or subscribing to blocks, enabling access to files and subscriptions from boards they should not have access to. To address this issue, users should upgrade Mattermost to versions 10.11.5 or 10.5.13. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13870.

In Mattermost versions 11.0.x up to 11.0.2, 10.12.x up to 10.12.1, 10.11.x up to 10.11.4 and 10.5.x up to 10.5.12 a medium severity vulnerability CVE-2025-12756 was detected. This vulnerability allows authenticated users with the editor role to bypass permission checks and delete comments created by other users in Boards. To address this issue, users should upgrade Mattermost to versions 11.0.3 or later, 10.12.2 or later, 10.11.5 or later, and 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12756.

In Mattermost versions 10.11.x through 10.11.4 and 10.5.x through 10.5.12 a low severity vulnerability CVE-2025-13870 was identified. This vulnerability allows authenticated users to bypass permission validation when accessing files and subscribing to blocks in Boards. As a result, users can access files and subscribe to blocks on other boards they do not have permission to view. To address this issue, users should upgrade Mattermost to versions 10.11.5, 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13870.

In Mattermost versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12 a medium severity vulnerability CVE-2025-12756 was identified. The issue stems from insufficient permission validation in Boards when handling comment deletions, allowing an authenticated user with the editor role to delete comments created by other users. This can lead to unauthorized modification of project information and loss of important discussion history. To address this issue, users should upgrade Mattermost to versions 11.0.3, 10.12.2, 10.11.5, 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12756.

In Mattermost versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12 a critical severity vulnerability CVE-2025-12421 was detected. This vulnerability allows an authenticated user to perform account takeover via a specially crafted email address when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. This is due to failure to verify that the token used during the code exchange originates from the same authentication flow. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled). To address this issue, users should upgrade Mattermost to versions 11.0.3, 10.12.2, 10.11.5, 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12421.

In Mattermost versions 10.12.x through 10.12.1, 10.11.x through 10.11.4, 10.5.x through 10.5.12, and 11.0.x through 11.0.3 a critical severity vulnerability CVE-2025-12419 was detected. This vulnerability allows an authenticated attacker with team creation privileges to take over a user account by manipulating authentication data during the OAuth completion flow. This is due to improper validation of OAuth state tokens during OpenID Connect authentication. The vulnerability requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system, with one user never having logged into Mattermost. To address this issue, users should upgrade Mattermost to versions 10.12.2, 10.11.5, 10.5.13, and 11.0.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12419.

In Mattermost versions 11.0.x through 11.0.2, 10.12.x through 10.12.1, 10.11.x through 10.11.4, and 10.5.x through 10.5.12 a medium severity vulnerability CVE-2025-12559 was detected. This vulnerability allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint due to failure to sanitize team email addresses to be visible only to Team Admins. To address this issue, users should upgrade Mattermost to versions 11.0.3, 10.12.2, 10.11.5, 10.5.13 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12559.

In LimeSurvey versions up to and including 6.13.0 a medium severity vulnerability CVE-2025-41074 was detected. This issue allows unauthenticated attackers to trigger an infinite redirect loop by directly accessing the /optout endpoint, potentially leading to a denial‑of‑service condition through excessive server or client resource consumption. To address this issue, users should upgrade LimeSurvey to version 6.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41074.

In Mattermost versions 10.11.x through 10.11.3 and 10.5.x through 10.5.11 a low severity vulnerability CVE-2025-55074 was detected. This vulnerability causes Mattermost to fail to enforce access permissions on the Agents plugin, allowing other users to determine when users had read channels via channel member objects. Fixed versions include 11.0.0, 10.11.4, and 10.5.12. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55074.