Our news and updates

In Mattermost versions 10.5.0 to 10.5.1, 10.4.0 to 10.4.3, and 9.11.0 to 9.11.9 a low severity vulnerability CVE-2025-24839 was detected. This vulnerability allows users to turn on the AI bot by adding a setting to a post using the Wrangler plugin, even if they don’t have access to the bot. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-24839.

In Mattermost versions 10.5.x ≤ 10.5.1, 10.4.x ≤ 10.4.3 and 9.11.x ≤ 9.11.9 a medium severity vulnerability CVE-2025-2475 was detected. This vulnerability allows attackers to log in once using normal credentials after a user account is converted to a bot, due to improper cache invalidation. To address this issue, users should upgrade Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2475.

In Mattermost versions 10.5.x ≤ 10.5.1 and 9.11.x ≤ 9.11.9 a low severity vulnerability CVE-2025-2424 was detected. This vulnerability allows attackers who know the IDs of deleted files to obtain their metadata by creating bookmarks, due to missing checks on file deletion. To address this issue, users should upgrade Mattermost to versions 10.5.2 or later for the 10.5.x series and 9.11.10 or later for the 9.11.x series. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-2424.

In Mattermost versions 10.4.x ≤ 10.4.2, 10.5.x ≤ 10.5.0 and 9.11.x ≤ 9.11.9 a low severity vulnerability CVE-2025-31363 was detected. This vulnerability allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim by performing a prompt injection in the AI plugin’s Jira tool, due to a failure to restrict domains the LLM can request. To address this issue, users should upgrade Mattermost to versions 10.6.0, 10.4.3, 10.5.1, 9.11.10 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-31363.

In Mattermost Plugin MS Teams versions <2.1.0 and Mattermost Server versions 10.5.x ≤ 10.5.1 with the MS Teams plugin enabled a medium severity vulnerability CVE-2025-27936 was detected. This vulnerability allows an attacker to retrieve the webhook secret of the MS Teams plugin via a timing attack, due to a failure to perform constant time comparison on the webhook secret. To address this issue, users should upgrade Mattermost Plugin MSTeams to version 2.1.1 or Mattermost Server to versions 10.6.0, 10.5.2 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27936.

In Mattermost versions 10.5.x ≤ 10.5.1, 10.4.x ≤ 10.4.3 and 9.11.x ≤ 9.11.9 a medium severity vulnerability CVE-2025-27571 was detected. This vulnerability allows authenticated users to access channel metadata from archived channels regardless of the “Allow Users to View Archived Channels” configuration setting. To address this issue, users should upgrade Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-27571.

In Mattermost versions 10.5.x up to and including 10.5.1, 10.4.x up to and including 10.4.3, and 9.11.x up to and including 9.11.9 a medium severity vulnerability CVE-2025-32093 was detected. This vulnerability allows delegated granular administration users with the “Edit Other Users” permission to perform unauthorized modifications to system administrator accounts due to improper permission validation. To address this issue, users should upgrade Mattermost to versions 10.6.0, 10.5.2, 10.4.4, 9.11.10 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-32093.

In Mattermost Mobile Apps versions 2.25.0 and prior a low severity vulnerability CVE-2025-30516 was detected. This vulnerability causes sessions to remain active during logout under certain conditions (e.g., poor connectivity), potentially allowing unauthorized users on shared devices to access sensitive information via continued mobile notifications. To address this issue, users should update Mattermost Mobile Apps to versions 2.26.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-30516.

In SUSE Rancher versions from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7 and from 2.10.0 before 2.10.3 a medium severity vulnerability CVE-2025-23387 was detected. This vulnerability allows unauthenticated attackers to list and delete CLI authentication tokens before they are retrieved, exposing sensitive information. To address this issue, users should upgrade SUSE Rancher to versions 2.8.13, 2.9.7 or 2.10.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-23387.