CVE-2025-25068

Summary

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost10.4.0 <= 10.4.2affected
MattermostMattermost10.3.0 <= 10.3.3affected
MattermostMattermost9.11.0 <= 9.11.8affected
MattermostMattermost10.5.0affected
MattermostMattermost10.6.0unaffected
MattermostMattermost10.4.3unaffected
MattermostMattermost10.3.4unaffected
MattermostMattermost9.11.9unaffected
MattermostMattermost10.5.1unaffected

Weaknesses

  • CWE-306: CWE-306: Missing Authentication for Critical Function

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References