CVE-2025-13870

Published: Dec 2, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to

Affected (2)

Products: Mattermost: Mattermost Server

1 product

Mattermost Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	From 10.11.0 to 10.11.5
Mattermost Mattermost Server	From 10.5.0 to 10.5.13

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

Timeline

No history available yet.