CVE-2025-12756CWE-863broken-access-control

CVE-2025-12756

Medium · published December 2, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-12-02T01:15Z
Affected products (4)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.5.0, < 10.5.1310.5.13
mattermost/mattermost_server≥ 10.11.0, < 10.11.510.11.5
mattermost/mattermost_server≥ 10.12.0, < 10.12.210.12.2
mattermost/mattermost_server≥ 11.0.0, < 11.0.311.0.3
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 01 DEC 19:51Z
    Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion
    cvelistv5