CVE-2025-49810

published 2025-08-21

CVE-2025-49810: Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts

Priority P4 21 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts

Affected

5 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 10.5.0 < 10.5.9	10.5.9
github.com	mattermost_mattermost-server	>= 10.5.0+incompatible < 10.5.9+incompatible	10.5.9+incompatible
github.com	mattermost_mattermost_server_v8	>= 0 < 8.0.0-20250721095846-c602a4a78e1f	8.0.0-20250721095846-c602a4a78e1f
mattermost	mattermost	10.5.0 – 10.5.8	—
mattermost	mattermost_server	>= 10.5.0 < 10.5.9	10.5.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863