CVE-2025-9081CWE-639

CVE-2025-9081

Low · published September 20, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-09-20T00:15Z
Affected products (2)
ProductVersionsFixed in
mattermost/mattermost_server≥ 9.11.0, < 9.11.179.11.17
mattermost/mattermost_server≥ 10.5.0, < 10.5.910.5.9
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 19 SEP 19:36Z
    IDOR in board file download allows any user to download any file by UUID
    cvelistv5