CVE-2025-11794

MEDIUM

Mattermost 10.5.0-10.5.11, 10.11.0-10.11.3, 10.12.0 - Unauthorized Exposure of Password Hashes and MFA Secrets

Title source: llm
STIX 2.1

Description

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint

References (1)

Core 1
Core References

Scores

CVSS v3 4.9
EPSS 0.0004
EPSS Percentile 13.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (3)
mattermost/mattermost 0 - 8.0.0-20250929212932-a41db04d2746Go
mattermost/mattermost-server 10.11.0 - 10.11.4Go
mattermost/mattermost_server 10.5.0 - 10.5.12
Published Nov 14, 2025
Tracked Since Feb 18, 2026