Moderate severityNVD Advisory· Published Nov 14, 2025· Updated Nov 14, 2025

Lack of MFA enforcement in WebSocket connections

CVE-2025-55070

Description

Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/mattermost/mattermost-serverGo	< 11.1.0	11.1.0
github.com/mattermost/mattermost/server/v8Go	< 8.0.0-20250912063506-7d8b7b5e4a60	8.0.0-20250912063506-7d8b7b5e4a60

Affected products

ghsa-coords2 versions
pkg:golang/github.com/mattermost/mattermost-server pkg:golang/github.com/mattermost/mattermost/server/v8
< 11.1.0+ 1 more
- (no CPE)range: < 11.1.0
- (no CPE)range: < 8.0.0-20250912063506-7d8b7b5e4a60
Mattermost/Mattermostv5
Range: <11

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xpg8-8xpv-948pghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-55070ghsaADVISORY
github.com/mattermost/mattermost/commit/7d8b7b5e4a6076b2f7c87606883c417f9a610df5ghsaWEB
mattermost.com/security-updatesghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000