cbcvebase.
CVE-2025-24839
published 2025-04-16

CVE-2025-24839: Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows…

medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.

Affected

14 ranges
VendorProductVersion rangeFixed in
github.commattermost_mattermost-server>= 10.4.0+incompatible < 10.4.4+incompatible10.4.4+incompatible
github.commattermost_mattermost-server>= 10.5.0+incompatible < 10.5.2+incompatible10.5.2+incompatible
github.commattermost_mattermost-server>= 9.11.0+incompatible < 9.11.10+incompatible9.11.10+incompatible
github.commattermost_mattermost_server_v8>= 0 < 8.0.0-20250314142426-c049748b88638.0.0-20250314142426-c049748b8863
github.commattermost_mattermost_server_v8>= 0 < 8.0.0-20250218121836-2b5275d871368.0.0-20250218121836-2b5275d87136
github.commattermost_mattermost_server_v8>= 10.4.0 < 10.4.410.4.4
github.commattermost_mattermost_server_v8>= 10.5.0 < 10.5.210.5.2
github.commattermost_mattermost_server_v8>= 9.11.0 < 9.11.109.11.10
mattermostmattermost10.4.0 – 10.4.3
mattermostmattermost10.5.0 – 10.5.1
mattermostmattermost9.11.0 – 9.11.9
mattermostmattermost_server>= 10.4.0 < 10.4.410.4.4
mattermostmattermost_server>= 10.5.0 < 10.5.210.5.2
mattermostmattermost_server>= 9.11.0 < 9.11.109.11.10