CVE-2025-0503

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-0503

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0503.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-0503

Published

2025-02-14T17:52:17Z

Modified

2026-08-12T03:51:29Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Leaked User IDs and Metadata of Deleted DMs

Details

Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

Database specific

{
    "cna_assigner": "Mattermost",
    "cwe_ids": [
        "CWE-754"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0503.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.11.0"
                },
                {
                    "last_affected": "9.11.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type

GIT

Repo

https://github.com/mattermost/mattermost

Events

Introduced

0bc2ddd42375a75ab14e63f038165150d4f07659

Fixed

6519009694d3a09586df7632261b441238d91f74

Database specific

Show details

{
    "cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.11.0"
        },
        {
            "fixed": "9.11.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

@mattermost/client@9.*

@mattermost/client@9.11.0

@mattermost/types@9.*

@mattermost/types@9.11.0

v9.*

v9.11.0

v9.11.0-rc3

v9.11.1

v9.11.1-rc1

v9.11.2

v9.11.2-rc1

v9.11.2-rc2

v9.11.3

v9.11.3-rc1

v9.11.3-rc2

v9.11.4

v9.11.4-rc1

v9.11.5

v9.11.5-rc1

v9.11.6

v9.11.6-rc1

v9.11.6-rc2

v9.11.7-rc1

v9.11.7-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0503.json"