CVE-2025-30179CWE-863

MFA Enforcement Bypass in Search APIs

Medium · published March 21, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-03-21T08:24Z
EPSS history
Timeline
  • 21 MAR 08:24Z
    MFA Enforcement Bypass in Search APIs
    cvelistv5