Communication and Collaboration

In Mattermost versions prior to 11 a medium severity vulnerability CVE-2025-11776 was identified. This vulnerability allows guest users to bypass access restrictions on the archived channel search API and discover archived public channels via the /api/v4/teams/{team_id}/channels/search_archived endpoint. To fix this vulnerability, users should upgrade Mattermost to version 11 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11776.

Mattermost versions 10.11.x through 10.11.3, 10.5.x through 10.5.11, and 10.12.x through 10.12.0 contain a medium severity vulnerability CVE-2025-11794. This vulnerability allows system administrators to access password hashes and MFA secrets due to improper sanitization of user data in the POST /api/v4/users/{user_id}/email/verify/member endpoint. To address this issue, users should upgrade Mattermost to version 10.11.4, 10.5.12, or 10.12.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11794.

In Mattermost versions 10.11.0 through 10.11.3, 10.5.0 through 10.5.11, and 10.12.0 a medium severity vulnerability CVE-2025-55073 was identified in the MS Teams plugin OAuth flow. The plugin fails to properly validate the relationship between the post being updated and the OAuth authorization redirect, allowing an attacker to craft a malicious MSTeams plugin OAuth redirect URL and edit arbitrary posts. To fix this vulnerability, users should upgrade Mattermost to versions 11.0.0, 10.11.4, 10.5.12, or 10.12.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55073.

In Mattermost versions prior to 11 a medium severity vulnerability CVE-2025-55070 was identified. This vulnerability allows unauthenticated users to bypass multi-factor authentication enforcement on WebSocket connections, potentially leading to unauthorized access to sensitive information via WebSocket events. To fix this vulnerability, users should upgrade Mattermost to version 11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55070.

In Mattermost versions prior to 11.0 a low severity vulnerability CVE-2025-41436 was identified. This vulnerability allows regular users to bypass the “Allow users to view archived channels” setting and access archived channel content and files via the “Open in Channel” functionality from followed threads. To fix this vulnerability, users should upgrade Mattermost to version 11.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41436.

In Discourse versions prior to 3.6.2 and 3.6.0.beta2 a medium severity vulnerability CVE-2025-61598 was identified. The default Cache-Control response header with value no-store, no-cache was missing from error responses, which could result in unintended caching by proxies and potentially enable cache poisoning attacks. To fix this issue, users should upgrade to Discourse 3.6.2 or 3.6.0.beta2. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-61598.

In Mastodon versions 4.2.27 through 4.2.x, 4.3.0 through 4.3.14, and 4.4.0 through 4.4.6 a medium severity vulnerability CVE-2025-62176 was detected. The streaming server serves public timeline events to clients with valid tokens even if they lack the read:statuses scope, allowing limited access to new public posts. To address this issue, users should upgrade Mastodon to versions 4.2.27, 4.3.14, or 4.4.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62176.

In Mastodon versions 4.2.27 through 4.2.x, 4.3.0 through 4.3.14, and 4.4.0 through 4.4.6 a medium severity vulnerability CVE-2025-62175 was detected. Disabling or suspending user accounts does not disconnect them from the streaming API, allowing continued access to real-time updates. To address this issue, users should upgrade Mastodon to versions 4.2.27, 4.3.14, or 4.4.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62175.

In Mastodon versions 4.2.27 through 4.2.x, 4.3.0 through 4.3.14, and 4.4.0 through 4.4.6 a low severity vulnerability CVE-2025-62174 was detected. Active sessions and access tokens are not revoked when a user’s password is reset via the command-line interface, allowing continued access to the account. To address this issue, users should upgrade Mastodon to versions 4.2.27, 4.3.14, or 4.4.6 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-62174.