Mattermost up to 9.11.9/10.5.1/10.5.x MFA mfa missing authentication

Summaryinfo

A vulnerability was found in Mattermost up to 9.11.9/10.5.1/10.5.x. It has been classified as critical. This impacts an unknown function of the file /api/v4/users/user-id/mfa of the component MFA. Performing a manipulation results in missing authentication. This vulnerability is known as CVE-2025-27538. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Mattermost up to 9.11.9/10.5.1/10.5.x. This affects an unknown code block of the file /api/v4/users/user-id/mfa of the component MFA. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on integrity. The summary by CVE is:

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.

The weakness was published by 0x7oda7123. It is possible to read the advisory at mattermost.com. This vulnerability is uniquely identified as CVE-2025-27538 since 04/08/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 234796 (Mattermost Server 9.11.x < 9.11.10 / 10.5.x < 10.5.2 / 10.6.0 (MMSA-2025-00453)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.11.10, 10.5.2 or 10.6.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234796). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 9.11.0
• 9.11.1
• 9.11.2
• 9.11.3
• 9.11.4
• 9.11.5
• 9.11.6
• 9.11.7
• 9.11.8
• 9.11.9
• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.5.0
• 10.5.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion