CVE-2025-27538 — Missing Authentication for Critical Function in Mattermost Mattermost-server

CWE-306 — Missing Authentication for Critical Function5 documents4 sources
Severity
2.7LOWNVD
CNA2.2
EPSS
0.2%
top 60.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Mattermost Mattermost-serverGithub.com Mattermost Mattermost Server V8Mattermost Server+1 more
Timeline
PublishedApr 16
Latest updateApr 22

Description

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages4 packages

▶NVDmattermost/mattermost_server9.11.0 — 9.11.10+1
▶Gogithub.com/mattermost_mattermost-server9.11.0+incompatible — 9.11.10+incompatible+1
▶CVEListV5mattermost/mattermost10.5.0 — 10.5.1+1

🔴Vulnerability Details

4
OSV
Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server↗2025-04-22
▶
OSV
Mattermost Missing Authentication for Critical Function↗2025-04-16
▶
GHSA
Mattermost Missing Authentication for Critical Function↗2025-04-16
▶
CVEList
MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users↗2025-04-16
▶
CVE-2025-27538 — LOW severity | cvebase