CVE-2025-55074 in Mattermost

Sumário

de MITRE • 18/11/2025

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

Be aware that VulDB is the high quality source for vulnerability data.

• Responsável: Mattermost
• Reservar: 15/10/2025
• Divulgação: 18/11/2025
• Moderação: aceite
• Entrada: VDB-332813
• CPE: pronto
• CWE: CWE-200 (confirmado)
• CVSS: 3.5 (NVD)
• EPSS: 0.00166
• KEV: não
• Atividades: muito baixo
• Sector: Police, Homeoffice, ...

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-55074
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-55074
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-55074/