CVE-2025-13870

Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

18 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 10.11.x menor o igual que 10.11.4, 10.5.x menor o igual que 10.5.12 fallan al validar el permiso del usuario al acceder a los archivos y suscribirse al bloque en Boards, lo que permite a un usuario autenticado acceder a archivos de otras pizarras y pudo suscribirse al bloque de otras pizarras a las que el usuario no tiene acceso.

Information

Published : 2025-12-02 10:16

Updated : 2026-10-18 18:10

NVD link : CVE-2025-13870

Mitre link : CVE-2025-13870

CVE.ORG link : CVE-2025-13870

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-13870", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13870", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T14:38:15.737706Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.4"}, {"status": "affected", "version": "10.5.0", "versionType": "semver", "lessThanOrEqual": "10.5.12"}, {"status": "unaffected", "version": "11.1.0"}, {"status": "unaffected", "version": "10.11.5"}, {"status": "unaffected", "version": "10.5.13"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-02T10:16:01.270", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to"}, {"lang": "es", "value": "Las versiones de Mattermost 10.11.x menor o igual que 10.11.4, 10.5.x menor o igual que 10.5.12 fallan al validar el permiso del usuario al acceder a los archivos y suscribirse al bloque en Boards, lo que permite a un usuario autenticado acceder a archivos de otras pizarras y pudo suscribirse al bloque de otras pizarras a las que el usuario no tiene acceso."}], "lastModified": "2026-10-18T18:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91D99F7F-B4EE-447C-9B77-82DD64B1D83A", "versionEndExcluding": "10.5.13", "versionStartIncluding": "10.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8368192-621C-4043-827E-DB4F6946AD92", "versionEndExcluding": "10.11.5", "versionStartIncluding": "10.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}