CVE-2025-55073

published 2025-11-14

CVE-2025-55073: Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams…

Priority P4 31 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C N I L A N

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 10.11.0 < 10.11.4	10.11.4
github.com	mattermost_mattermost-server	>= 10.11.0+incompatible < 10.11.4+incompatible	10.11.4+incompatible
github.com	mattermost_mattermost-server	>= 10.12.0 < 10.12.1	10.12.1
github.com	mattermost_mattermost-server	>= 10.12.0+incompatible < 10.12.1+incompatible	10.12.1+incompatible
github.com	mattermost_mattermost-server	>= 10.5.0 < 10.5.12	10.5.12
github.com	mattermost_mattermost-server	>= 10.5.0+incompatible < 10.5.12+incompatible	10.5.12+incompatible
github.com	mattermost_mattermost_server_v8	>= 0 < 8.0.0-20250929212932-a41db04d2746	8.0.0-20250929212932-a41db04d2746
mattermost	mattermost	10.11.0 – 10.11.3	—
mattermost	mattermost	10.12.0 – 10.12.0	—
mattermost	mattermost	10.5.0 – 10.5.11	—
mattermost	mattermost_server	>= 10.11.0 < 10.11.4	10.11.4
mattermost	mattermost_server	>= 10.12.0 < 10.12.1	10.12.1
mattermost	mattermost_server	>= 10.5.0 < 10.5.12	10.5.12

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306