Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to
References
| Link | Resource |
|---|---|
| https://mattermost.com/security-updates | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
03 Dec 2025, 20:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* | |
| First Time |
Mattermost
Mattermost mattermost Server |
|
| References | () https://mattermost.com/security-updates - Vendor Advisory |
02 Dec 2025, 10:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-02 10:16
Updated : 2025-12-03 20:57
NVD link : CVE-2025-13870
Mitre link : CVE-2025-13870
CVE.ORG link : CVE-2025-13870
JSON object : View
Products Affected
mattermost
- mattermost_server
CWE
CWE-306
Missing Authentication for Critical Function