← Back

CVE-2025-9078

nvd nist
Published: Sep 15, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing

Affected (5)

Mattermost
1 product
Mattermost Server
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
From 10.10.0 to 10.10.2
Mattermost Server
From 10.5.0 to 10.5.9
Mattermost Server
From 10.8.0 to 10.8.4
Mattermost Server
From 10.9.0 to 10.9.4
Mattermost Server
From 9.11.0 to 9.11.18

Related CWEs

CWE-328
Use of Weak Hash
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.