CVE-2025-55074 in Mattermost

Riassunto

di MITRE • 18/11/2025

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

Be aware that VulDB is the high quality source for vulnerability data.

• Responsabile: Mattermost
• Prenotare: 15/10/2025
• Divulgazione: 18/11/2025
• Moderazione: accettato
• Voce: VDB-332813
• CPE: pronto
• CWE: CWE-200 (confermato)
• CVSS: 3.5 (NVD)
• EPSS: 0.00166
• KEV: no
• Attività: molto basso
• Settore: Hostingprovider, Insurance, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-55074
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-55074
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-55074/