Cloudanix VulnDB

CVE-2025-13870

Low · 3.1

Mattermost fails to validate user permissions in Boards

CVSS

3.1

EPSS

0.2%

Published

Dec 2, 2025

CISA due date

—

The record

Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost 10.11.0 10.11.5
Go github.com/mattermost/mattermost 10.5.0 10.5.13
Go github.com/mattermost/mattermost 10.5.0+incompatible 10.5.13+incompatible
Go github.com/mattermost/mattermost-server 0 No fix
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20250905150616-ba86dfc5876b
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20251212204551-54f2e9b4afd5
SUSE:Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1
go github.com/mattermost/mattermost 10.11.0 10.11.5
go github.com/mattermost/mattermost 10.5.0 10.5.13
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251230T014957-150000.1.134.1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1

Related vulnerabilities