Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://mattermost.com/security-updates |
Configurations
No configuration.
History
18 Jul 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-18 09:15
Updated : 2025-07-18 09:15
NVD link : CVE-2025-6226
Mitre link : CVE-2025-6226
JSON object : View
Products Affected
No product.
CWE
No CWE.