CVE-2025-9076CWE-862broken-access-control

CVE-2025-9076

Medium · published September 15, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-09-15T14:15Z
Affected products (1)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.10.0, < 10.10.210.10.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 15 SEP 10:06Z
    Mattermost Server exposes sensitive user credentials during shared channel membership synchronization
    cvelistv5