CVE-2025-13870

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-13870
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13870.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-13870
Aliases
Downstream
Related
Published
2025-12-02T09:28:44.436Z
Modified
2026-07-15T01:49:12.135367495Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Unauthorized access and subscription vulnerability in Boards
Details

Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "10.11.0"
                },
                {
                    "last_affected": "10.11.4"
                },
                {
                    "introduced": "10.5.0"
                },
                {
                    "last_affected": "10.5.12"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "Mattermost",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13870.json"
}
References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Introduced
58bd34fd34cbd7d3da777d627b6cffdf8a532930
Fixed
288281e8cbf15260ad074b883a263b796cdb3e28
Introduced
5b955468ea1ea8b56c0fb10feb258a36a767d7bb
Fixed
46b5c436bb3093cc1da3fa2455f93d4c52389eee
Database specific 
{
    "cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "10.5.0"
        },
        {
            "fixed": "10.5.13"
        },
        {
            "introduced": "10.11.0"
        },
        {
            "fixed": "10.11.5"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

@mattermost/client@10.*
@mattermost/client@10.11.0
@mattermost/client@10.5.0
@mattermost/types@10.*
@mattermost/types@10.11.0
@mattermost/types@10.5.0
mattermost-redux@10.*
mattermost-redux@10.11.0
v10.*
v10.11.0
v10.11.0-rc3
v10.11.1
v10.11.1-rc1
v10.11.2
v10.11.2-rc1
v10.11.2-rc2
v10.11.3
v10.11.4
v10.11.4-rc1
v10.11.4-rc2
v10.11.4-rc3
v10.5.0
v10.5.0-rc6
v10.5.1
v10.5.1-rc1
v10.5.1-rc2
v10.5.10
v10.5.10-rc1
v10.5.10-rc2
v10.5.11
v10.5.11-rc1
v10.5.12
v10.5.12-rc1
v10.5.2
v10.5.3
v10.5.3-rc1
v10.5.4
v10.5.4-rc1
v10.5.4-rc2
v10.5.5
v10.5.5-rc1
v10.5.6
v10.5.6-rc1
v10.5.7
v10.5.8
v10.5.8-rc1
v10.5.9
v10.5.9-rc1
v10.5.9-rc2
v10.5.9-rc3
v10.5.9-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13870.json"