CVE-2025-6226: IDOR in CreatePost API allows for timeboxed message disclosure
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
Other sources
Mattermost versions 10.5.x <= 10.5.7, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.0.0-20250520130510-fa40a8c5d47f - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 9.11.17 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.7.4 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.8.2 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.5.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.5.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.7.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.9.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.17
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6226?
CVE-2025-6226 has been classified with a severity rating of high due to its potential to expose private channel posts.
How do I fix CVE-2025-6226?
To fix CVE-2025-6226, upgrade Mattermost to versions above 10.5.6, 10.8.1, 10.7.3, or 9.11.16.
Who is affected by CVE-2025-6226?
Users utilizing Mattermost versions 10.5.x up to 10.5.6, 10.8.x up to 10.8.1, 10.7.x up to 10.7.3, or 9.11.x up to 9.11.16 are affected by CVE-2025-6226.
What type of vulnerability is CVE-2025-6226?
CVE-2025-6226 is an authorization vulnerability that allows users to access restricted posts in private channels.
Can CVE-2025-6226 be exploited remotely?
Yes, CVE-2025-6226 can be exploited by an authenticated user remotely through the manipulation of PendingPostID.