Medium severity6.5NVD Advisory· Published Jul 18, 2025· Updated Jun 17, 2026
CVE-2025-6226
CVE-2025-6226
Description
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost-serverGo | >= 10.5.0, < 10.5.7 | 10.5.7 |
github.com/mattermost/mattermost-serverGo | >= 10.8.0, < 10.8.2 | 10.8.2 |
github.com/mattermost/mattermost-serverGo | >= 10.7.0, < 10.7.4 | 10.7.4 |
github.com/mattermost/mattermost-serverGo | >= 9.11.0, < 9.11.17 | 9.11.17 |
github.com/mattermost/mattermost/server/v8Go | < 8.0.0-20250520130510-fa40a8c5d47f | 8.0.0-20250520130510-fa40a8c5d47f |
Affected products
5cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*range: >=9.11.0,<9.11.17
- (no CPE)range: 10.5.0
- ghsa-coords3 versionspkg:golang/github.com/mattermost/mattermost-serverpkg:golang/github.com/mattermost/mattermost/server/v8pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
>= 10.5.0, < 10.5.7+ 2 more
- (no CPE)range: >= 10.5.0, < 10.5.7
- (no CPE)range: < 8.0.0-20250520130510-fa40a8c5d47f
- (no CPE)range: < 0.0.20250730T213748-1.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-7h34-9chr-58qhghsaADVISORY
- mattermost.com/security-updatesnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2025-6226ghsaADVISORY
- github.com/mattermost/mattermost/commit/fa40a8c5d47fed5c166429a1c1bd95d62b241d89ghsaWEB
News mentions
0No linked articles in our index yet.