CVE-2025-0503: Leaked User IDs and Metadata of Deleted DMs
Published Feb 14, 2025
·Updated
Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.
Affected Software
2 affected components
Mattermost Mattermost<=9.11.6
Mattermost Mattermost Server>=9.11.0<9.11.7
Remediation
Information
Update Mattermost to versions 10.4.0, 9.11.7 or higher.
Event History
Feb 14, 2025
CVE Published
via MITRE·05:52 PM
Data Sourced
via MITRE·05:52 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-0503?
CVE-2025-0503 has a high severity rating due to its potential to expose sensitive user information.
2
How do I fix CVE-2025-0503?
To fix CVE-2025-0503, upgrade Mattermost to version 9.11.7 or later where the issue is resolved.
3
What impact does CVE-2025-0503 have on Mattermost users?
CVE-2025-0503 allows attackers to infer user IDs and metadata from deleted direct messages, compromising user privacy.
4
Which versions of Mattermost are affected by CVE-2025-0503?
Mattermost versions 9.11.x up to and including 9.11.6 are affected by CVE-2025-0503.
5
Can CVE-2025-0503 be exploited remotely?
Yes, CVE-2025-0503 can potentially be exploited remotely if an attacker has access to the deleted channels endpoint.