Communication and Collaboration

In Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 and 10.9.x <= 10.9.2 a medium severity vulnerability CVE-2025-47870 was detected. This vulnerability allows a Team Admin with no member invite privileges to get the team's invite ID. To address this issue, users should upgrade Mattermost to versions 10.10.0, 10.8.4, 10.5.9, 9.11.18, 10.9.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-47870.

In Discourse versions before 3.4.7 and from 3.5.0.beta1 to before 3.5.0.beta.8 a high severity vulnerability CVE-2025-53102 was detected. This vulnerability allows attackers to reuse a 2FA security key challenge after login, which increases the risk of unauthorized access. To address this issue, users should upgrade Discourse to versions 3.4.7, 3.5.0.beta.8 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-53102.

In Mattermost versions 10.8.x up to 10.8.1, 10.7.x up to 10.7.3, 10.5.x up to 10.5.7 and 9.11.x up to 9.11.16 a medium severity vulnerability CVE-2025-6233 was detected. This vulnerability allows system administrators to read arbitrary system files via path traversal due to improper sanitization of file attachment input paths in the bulk import JSONL file. To address this issue, users should upgrade Mattermost to versions 10.9.0, 10.8.2, 10.7.4, 10.5.8, 9.11.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6233.

In Mattermost versions 10.5.x up to 10.5.7 and 9.11.x up to 9.11.16 a low severity vulnerability CVE-2025-6227 was detected. This vulnerability allows an attacker who intercepts both the invite and password to send synchronization payloads to the server via the REST API due to failure to negotiate a new token when accepting the invite. To address this issue, users should upgrade Mattermost to versions 10.9.0, 10.5.8, 9.11.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6227.

In Mattermost versions 10.5.x up to 10.5.6, 10.8.x up to 10.8.1, 10.7.x up to 10.7.3 and 9.11.x up to 9.11.16 a medium severity vulnerability CVE-2025-6226 was detected. This vulnerability allows authenticated users to read posts in private channels without proper access by guessing PendingPostIDs of recently created posts due to missing authorization checks. To address this issue, users should upgrade Mattermost to versions 10.9.0, 10.5.8, 9.11.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6226.

In Zulip Server versions from 2.0.0-rc1 to 10.4 a medium severity vulnerability CVE-2025-52559 was detected. This vulnerability allows attackers to inject and execute malicious scripts in users’ browsers by exploiting unsanitized topic or channel names in the /digest/ preview, potentially leading to data theft or session hijacking. To fix this issue, users should upgrade to Zulip Server version 10.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-52559.

In Mattermost versions 10.5.x up to 10.5.5, 9.11.x up to 9.11.15, 10.8.x up to 10.8.0, 10.7.x up to 10.7.2, and 10.6.x up to 10.6.5 a medium severity vulnerability CVE-2025-46702 was detected. This vulnerability allows attackers to gain unauthorized access to sensitive channel content and allows guest users to gain channel management privileges. To fix this issue, users should upgrade Mattermost to versions 10.5.6, 9.11.16, 10.8.1, 10.7.3, and 10.6.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46702.

In Mattermost versions up to and including 10.5.5, 9.11.15, 10.6.5, 10.7.2, and 10.8.0 a medium severity vulnerability CVE-2025-47871 was detected. This vulnerability allows authenticated users who are playbook members but not channel members to access sensitive information about linked private channels, including channel name, display name, and participant count, through the run metadata API endpoint. To address this issue users must upgrade to versions 10.5.6, 9.11.16, 10.6.6, 10.7.3, or 10.8.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-47871.

In Discourse versions prior to 3.5.0.beta6 a high severity vulnerability CVE-2025-48954 was detected. This vulnerability allows attackers to perform cross-site scripting (XSS) attacks when the content security policy is not enabled while using social logins. To address this issue, users should upgrade Discourse to versions 3.5.0.beta6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-48954.