CVE-2025-55070: Lack of MFA enforcement in WebSocket connections
Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.
Other sources
Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.0.0-20250912063506-7d8b7b5e4a60 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 11.1.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55070?
CVE-2025-55070 has a high severity rating due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2025-55070?
To mitigate CVE-2025-55070, upgrade Mattermost to version 11 or later to enforce multi-factor authentication on WebSocket connections.
What type of vulnerability is CVE-2025-55070?
CVE-2025-55070 is a security vulnerability related to improper enforcement of authentication in WebSocket connections.
Who is affected by CVE-2025-55070?
CVE-2025-55070 affects all Mattermost versions prior to 11.
What impact does CVE-2025-55070 have on users?
CVE-2025-55070 allows unauthenticated users to gain access to sensitive information, risking data confidentiality.