VULNERABILITY INTELLIGENCE

CVE-2025-0503

CVSS score3.1 LOW
EPSS probability0.25%
CISA KEVNot currently listed
Published2025-02-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-754

Primary references