CVE-2025-9078CWE-328

CVE-2025-9078

Medium · published September 15, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-328 · Use of Weak Hash
Published
2025-09-15T14:15Z
Affected products (5)
ProductVersionsFixed in
mattermost/mattermost_server≥ 9.11.0, < 9.11.189.11.18
mattermost/mattermost_server≥ 10.5.0, < 10.5.910.5.9
mattermost/mattermost_server≥ 10.8.0, < 10.8.410.8.4
mattermost/mattermost_server≥ 10.9.0, < 10.9.410.9.4
mattermost/mattermost_server≥ 10.10.0, < 10.10.210.10.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 15 SEP 10:10Z
    Weak cache keys lead to post IDOR and link preview poisoning
    cvelistv5