CVE-2025-9078: Weak cache keys lead to post IDOR and link preview poisoning
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9078?
CVE-2025-9078 is considered a high-severity vulnerability due to its potential to allow unauthorized access to posts.
How do I fix CVE-2025-9078?
To fix CVE-2025-9078, upgrade your Mattermost instance to a version higher than 10.8.3, 10.5.8, 9.11.17, 10.10.1, or 10.9.3.
Who is affected by CVE-2025-9078?
CVE-2025-9078 affects Mattermost versions 10.8.x up to 10.8.3, 10.5.x up to 10.5.8, 9.11.x up to 9.11.17, 10.10.x up to 10.10.1, and 10.9.x up to 10.9.3.
What types of attacks does CVE-2025-9078 enable?
CVE-2025-9078 enables authenticated users to perform hash collision attacks that could expose unauthorized posts and poison link previews.
Is there a workaround for CVE-2025-9078?
Currently, the recommended action for CVE-2025-9078 is to update to a patched version, as no workaround has been specified.