CVE-2025-9081: IDOR in board file download allows any user to download any file by UUID
Published Sep 19, 2025
·Updated
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
Affected Software
7 affected componentsFixes available
Mattermost Mattermost<=10.5.8, <=9.11.17
go/github.com/mattermost/mattermost-server>=9.11.0-rc1<9.11.18
9.11.18
go/github.com/mattermost/mattermost-server>=10.5.0-rc1<10.5.9
10.5.9
go/github.com/mattermost/mattermost/server/v8<8.0.0-20250721095935-11c36f4d1e44
8.0.0-20250721095935-11c36f4d1e44
go/github.com/mattermost/mattermost-plugin-boards<0.0.0-20250716054606-3f3e3becfe1d
0.0.0-20250716054606-3f3e3becfe1d
Mattermost Mattermost Server>=9.11.0<9.11.17
Mattermost Mattermost Server>=10.5.0<10.5.9
Remediation
Information
Update Mattermost to versions 10.11.0, 10.5.9, 9.11.18 or higher.
Event History
Sep 19, 2025
CVE Published
via MITRE·07:36 PM
Data Sourced
via MITRE·07:36 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·09:31 PM
Data Sourced
via GitHub·09:31 PM
DescriptionSeverityWeaknessAffected Software
Feb 28, 57989
Event
via FIRST·02:25 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-9081?
CVE-2025-9081 is considered a high-severity vulnerability due to its impact on sensitive file access.
2
How do I fix CVE-2025-9081?
To mitigate CVE-2025-9081, upgrade Mattermost to version 10.5.9 or 9.11.18 or later.
3
Who is affected by CVE-2025-9081?
CVE-2025-9081 affects Mattermost versions 10.5.x up to 10.5.8 and 9.11.x up to 9.11.17.
4
What kind of files can be accessed due to CVE-2025-9081?
CVE-2025-9081 allows any authenticated user to download sensitive files through the board file download endpoint.
5
What is the cause of CVE-2025-9081?
CVE-2025-9081 is caused by improper validation of access controls in specific Mattermost versions.