CVE-2025-12756

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 11.0.x anteriores o iguales a la 11.0.2, 10.12.x anteriores o iguales a la 10.12.1, 10.11.x anteriores o iguales a la 10.11.4 y 10.5.x anteriores o iguales a la 10.5.12 no validan los permisos de usuario al eliminar comentarios en Boards, lo que permite a un usuario autenticado con el rol de editor eliminar comentarios creados por otros usuarios.

Information

Published : 2025-12-01 20:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-12756

Mitre link : CVE-2025-12756

CVE.ORG link : CVE-2025-12756

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-12756", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12756", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T20:01:59.250891Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "11.0.0", "versionType": "semver", "lessThanOrEqual": "11.0.2"}, {"status": "affected", "version": "10.12.0", "versionType": "semver", "lessThanOrEqual": "10.12.1"}, {"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.4"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.12"}, {"status": "unaffected", "version": "11.1.0"}, {"status": "unaffected", "version": "11.0.3"}, {"status": "unaffected", "version": "10.12.2"}, {"status": "unaffected", "version": "10.11.5"}, {"status": "unaffected", "version": "10.5.13"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-01T20:15:49.147", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users."}, {"lang": "es", "value": "Las versiones de Mattermost 11.0.x anteriores o iguales a la 11.0.2, 10.12.x anteriores o iguales a la 10.12.1, 10.11.x anteriores o iguales a la 10.11.4 y 10.5.x anteriores o iguales a la 10.5.12 no validan los permisos de usuario al eliminar comentarios en Boards, lo que permite a un usuario autenticado con el rol de editor eliminar comentarios creados por otros usuarios."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91D99F7F-B4EE-447C-9B77-82DD64B1D83A", "versionEndExcluding": "10.5.13", "versionStartIncluding": "10.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8368192-621C-4043-827E-DB4F6946AD92", "versionEndExcluding": "10.11.5", "versionStartIncluding": "10.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED48D731-6490-4DD5-94D4-EE4555BB93ED", "versionEndExcluding": "10.12.2", "versionStartIncluding": "10.12.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A288B87-76F2-415B-8462-3D185EB7A9B3", "versionEndExcluding": "11.0.3", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}