Communication and Collaboration

In Mattermost versions 10.5.x through 10.5.10 and 10.11.x through 10.11.2 a low severity vulnerability CVE-2025-54499 was detected. Improper handling of sensitive string comparisons without constant-time enforcement allows attackers to exploit timing differences to perform byte-by-byte brute force attacks on Cloud API keys and OAuth client secrets. To address this issue, users should upgrade to Mattermost versions 10.5.11, 10.11.3, or 10.12.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-54499.

In Mattermost versions 10.5.x through 10.5.10 and 10.11.x through 10.11.2 a medium severity vulnerability CVE-2025-41443 was detected. Improper validation of guest user permissions allows attackers to discover active public channels and their metadata via the /api/v4/teams/{team_id}/channels/ids endpoint. To address this issue, users should upgrade to Mattermost versions 10.5.11, 10.11.3, or 10.12.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41443.

In Mattermost versions 10.5.x through 10.5.10, 10.10.x through 10.10.2, and 10.11.x through 10.11.2 a medium severity vulnerability CVE-2025-41410 was detected. Improper validation of email ownership during the Slack import process allows attackers to create verified user accounts with arbitrary email domains, bypassing email-based team access restrictions. To address this issue, users should upgrade to Mattermost versions 10.5.11, 10.10.3, 10.11.3, or 10.12.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-41410.

In Mattermost versions 10.5.x through 10.5.10, 10.10.x through 10.10.2, and 10.11.x through 10.11.1 a high severity vulnerability CVE-2025-58075 was detected. Improper validation of the SAML RelayState parameter allows attackers to join any team on a Mattermost server, bypassing invite restrictions. To address this issue, users should upgrade to Mattermost versions 10.5.11, 10.10.3, 10.11.2, or 10.12.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58075.

In Mattermost Desktop App versions up to 5.13.0 a medium severity vulnerability CVE-2025-58084 was detected. The application fails to validate URLs external to the configured Mattermost servers, allowing an attacker on a configured server to crash the user’s application by sending a malformed URL. To address this issue, users should upgrade the Mattermost Desktop App to version 5.13.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58084.

In Discourse versions up to and including 3.5.0 a medium severity vulnerability CVE-2025-59337 was detected. This issue allowed malicious meta-commands to be embedded in a backup dump and executed during restore. In multisite deployments, this could enable an admin of one site to access data or credentials from other sites. To address this issue, users should upgrade Discourse to version 3.5.1 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-59337.

In Discourse versions 3.5.0 and below a medium severity vulnerability CVE-2025-58055 was detected. The AI suggestion endpoints for topic “Title,” “Category,” and “Tags” allowed authenticated users to extract information about topics they weren’t authorized to access by modifying the topic_id parameter in API requests. To address this issue, users should upgrade Discourse to version 3.5.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58055.

In Discourse versions 3.5.0 and below a medium severity vulnerability CVE-2025-58054 was detected. The platform is vulnerable to Cross-Site Scripting attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. To address this issue, users should upgrade Discourse to version 3.5.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-58054.

In Mattermost versions 10.5.x ≤ 10.5.8 and 9.11.x ≤ 9.11.17 a low severity vulnerability CVE-2025-9081 was detected. This vulnerability allows any authenticated user to download sensitive files via the board file download endpoint using UUID enumeration due to improper access control validation. To fix this problem, users should upgrade to Mattermost version 10.5.9 or 9.11.18. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-9081.