Cloudanix VulnDB

CVE-2025-11794

Medium · 4.9

Mattermost allows system administrators to access password hashes and MFA secrets

CVSS

4.9

EPSS

0.3%

Published

Nov 14, 2025

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost-server 10.11.0 10.11.4
Go github.com/mattermost/mattermost-server 10.12.0 10.12.1
Go github.com/mattermost/mattermost-server 10.5.0 10.5.12
Go github.com/mattermost/mattermost-server 10.5.0+incompatible 10.5.12+incompatible
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20250929212932-a41db04d2746
go github.com/mattermost/mattermost-server 10.11.0 10.11.4
go github.com/mattermost/mattermost-server 10.12.0 10.12.1
go github.com/mattermost/mattermost-server 10.5.0 10.5.12

Related vulnerabilities