{"cve":"CVE-2025-13870","nvd":{"published":"2025-12-02T10:16:01.270","modified":"2026-10-18T18:10:00.100","status":"Analyzed","description":"Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-306"],"references":["https://mattermost.com/security-updates"],"products":["mattermost:mattermost_server"],"source":"nvd","synced_at":"2026-10-19T22:16:02.354564667+00:00"},"epss":{"cve":"CVE-2025-13870","score":0.00223,"percentile":0.12735,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-58w6-w55x-6wq8","url":"https://osv.dev/vulnerability/GHSA-58w6-w55x-6wq8","summary":"Mattermost fails to validate user permissions in Boards","modified":"2025-12-09T17:57:40.685506Z","packages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":["<8.0.0-20250905150616-ba86dfc5876b"],"fixed":["8.0.0-20250905150616-ba86dfc5876b"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost","purl":"pkg:golang/github.com/mattermost/mattermost","ranges":[">=10.11.0 <10.11.5"],"fixed":["10.11.5"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost","purl":"pkg:golang/github.com/mattermost/mattermost","ranges":[">=10.5.0 <10.5.13"],"fixed":["10.5.13"]}]},{"id":"GO-2025-4178","url":"https://osv.dev/vulnerability/GO-2025-4178","summary":"Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost","modified":"2026-03-03T04:57:45.103171Z","packages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost","purl":"pkg:golang/github.com/mattermost/mattermost","ranges":[">=10.5.0+incompatible <10.5.13+incompatible",">=10.11.0+incompatible <10.11.5+incompatible"],"fixed":["10.5.13+incompatible","10.11.5+incompatible"]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","purl":"pkg:golang/github.com/mattermost/mattermost-server","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v5","purl":"pkg:golang/github.com/mattermost/mattermost-server/v5","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server/v6","purl":"pkg:golang/github.com/mattermost/mattermost-server/v6","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8","ranges":["<8.0.0-20251212204551-54f2e9b4afd5"],"fixed":["8.0.0-20251212204551-54f2e9b4afd5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}