CVE-2025-12756: Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12756?
CVE-2025-12756 is considered a critical vulnerability due to its potential for unauthorized deletion of comments by users with editor roles.
How do I fix CVE-2025-12756?
To mitigate CVE-2025-12756, upgrade Mattermost Boards Plugin to version 11.0.3 or later, 10.12.2 or later, 10.11.5 or later, or 10.5.13 or later.
What versions are affected by CVE-2025-12756?
CVE-2025-12756 affects Mattermost Boards Plugin versions 11.0.x up to 11.0.2, 10.12.x up to 10.12.1, 10.11.x up to 10.11.4, and 10.5.x up to 10.5.12.
Who can exploit the vulnerability in CVE-2025-12756?
CVE-2025-12756 can be exploited by authenticated users who have the editor role in Mattermost Boards.
What impact does CVE-2025-12756 have on affected systems?
The impact of CVE-2025-12756 allows an editor to delete comments made by other users, compromising content integrity.