Moderate severityNVD Advisory· Published Jul 18, 2025· Updated Aug 7, 2025
IDOR in CreatePost API allows for timeboxed message disclosure
CVE-2025-6226
Description
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost-serverGo | >= 10.5.0, < 10.5.7 | 10.5.7 |
github.com/mattermost/mattermost-serverGo | >= 10.8.0, < 10.8.2 | 10.8.2 |
github.com/mattermost/mattermost-serverGo | >= 10.7.0, < 10.7.4 | 10.7.4 |
github.com/mattermost/mattermost-serverGo | >= 9.11.0, < 9.11.17 | 9.11.17 |
github.com/mattermost/mattermost/server/v8Go | < 8.0.0-20250520130510-fa40a8c5d47f | 8.0.0-20250520130510-fa40a8c5d47f |
Affected products
4- ghsa-coords3 versionspkg:golang/github.com/mattermost/mattermost-serverpkg:golang/github.com/mattermost/mattermost/server/v8pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
>= 10.5.0, < 10.5.7+ 2 more
- (no CPE)range: >= 10.5.0, < 10.5.7
- (no CPE)range: < 8.0.0-20250520130510-fa40a8c5d47f
- (no CPE)range: < 0.0.20250730T213748-1.1
- Range: 10.5.0
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.