CVE-2025-62190CWE-352csrf

CVE-2025-62190

Medium · published December 17, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00120 · 1.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-12-17T18:15Z
Affected products (3)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.710.11.7
mattermost/mattermost_server≥ 10.12.0, < 10.12.310.12.3
mattermost/mattermost_server≥ 11.0.0, < 11.0.511.0.5
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 17 DEC 12:07Z
    CSRF Allows Call Initiation and Message Delivery
    cvelistv5