{"id":"EUVD-2025-11360","enisaUuid":"cf6bbac8-12c5-3b67-8623-8dab58196dd8","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.1, 10.4.x \u003c\u003d 10.4.3, 9.11.x \u003c\u003d 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.","datePublished":"Apr 16, 2025, 7:44:20 AM","dateUpdated":"Apr 16, 2025, 2:34:44 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-24839\nGHSA-j639-m367-75cf\n","assigner":"Mattermost","epss":0.23,"enisaIdProduct":[{"id":"0cf7fc98-42e3-3278-878e-2ddd6ad4eb2a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.1"},{"id":"70621553-e080-3500-b5d0-ac21bd37c9a1","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.9"},{"id":"aa6e0f4e-4614-384f-afe7-a9db5b2c729f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.4.0 ≤10.4.3"}],"enisaIdVendor":[{"id":"32cc5b6d-206d-3718-bfc0-f30425938ea3","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"46a92124-09e8-36ce-89e0-406e0f5859f5","vulnerability":{"id":"CVE-2025-24839","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.1, 10.4.x \u003c\u003d 10.4.3, 9.11.x \u003c\u003d 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled.","datePublished":"Apr 16, 2025, 7:44:20 AM","dateUpdated":"Apr 16, 2025, 2:34:44 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-11360\n","assigner":"Mattermost","epss":0.23,"dataProcessed":"Nov 15, 2026, 5:17:40 AM","vulnerabilityProduct":[{"id":"2185f586-283e-32a7-8857-b0600f857d14","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.4.0 ≤10.4.3"},{"id":"62f9a6a3-6009-33c3-ba7a-95c7c8fd27c1","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.9"},{"id":"e8aa804f-22f4-3ed0-a16b-ad793bc71b0d","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.1"}],"vulnerabilityVendor":[{"id":"17a3082d-fc68-3779-bfe7-29b55378b671","vendor":{"name":"Mattermost"}}]}},{"id":"49b2a2da-3d71-3e5b-addf-f1aef67c264a","vulnerability":{"id":"GHSA-j639-m367-75cf","description":"Mattermost Incorrect Authorization vulnerability","datePublished":"Apr 16, 2025, 9:32:13 AM","dateUpdated":"Apr 23, 2025, 3:13:41 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-24839\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\nhttps://pkg.go.dev/vuln/GO-2025-3621\n","enisa_id":"EUVD-2025-11360\n","aliases":"CVE-2025-24839\nGHSA-j639-m367-75cf\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:42:04 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"918a37c4-aae4-36b8-80e9-b4193ceb4a25","advisory":{"id":"openSUSE-SU-2025:15017-1","description":"govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media","datePublished":"Apr 23, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:31:35 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15017-1.json\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/\nhttps://www.suse.com/security/cve/CVE-2019-15119/\nhttps://www.suse.com/security/cve/CVE-2025-1386/\nhttps://www.suse.com/security/cve/CVE-2025-2424/\nhttps://www.suse.com/security/cve/CVE-2025-24358/\nhttps://www.suse.com/security/cve/CVE-2025-2475/\nhttps://www.suse.com/security/cve/CVE-2025-24839/\nhttps://www.suse.com/security/cve/CVE-2025-24866/\nhttps://www.suse.com/security/cve/CVE-2025-2564/\nhttps://www.suse.com/security/cve/CVE-2025-27538/\nhttps://www.suse.com/security/cve/CVE-2025-27571/\nhttps://www.suse.com/security/cve/CVE-2025-27936/\nhttps://www.suse.com/security/cve/CVE-2025-30206/\nhttps://www.suse.com/security/cve/CVE-2025-31363/\nhttps://www.suse.com/security/cve/CVE-2025-32093/\nhttps://www.suse.com/security/cve/CVE-2025-32431/\nhttps://www.suse.com/security/cve/CVE-2025-32445/\nhttps://www.suse.com/security/cve/CVE-2025-32793/\nhttps://www.suse.com/security/cve/CVE-2025-32963/\nhttps://www.suse.com/security/cve/CVE-2025-3801/\nhttps://www.suse.com/security/cve/CVE-2025-43970/\nhttps://www.suse.com/security/cve/CVE-2025-43971/\nhttps://www.suse.com/security/cve/CVE-2025-43972/\nhttps://www.suse.com/security/cve/CVE-2025-43973/\n","aliases":"CVE-2019-15119\nCVE-2025-1386\nCVE-2025-2424\nCVE-2025-24358\nCVE-2025-2475\nCVE-2025-24839\nCVE-2025-24866\nCVE-2025-2564\nCVE-2025-27538\nCVE-2025-27571\nCVE-2025-27936\nCVE-2025-30206\nCVE-2025-31363\nCVE-2025-32093\nCVE-2025-32431\nCVE-2025-32445\nCVE-2025-32793\nCVE-2025-32963\nCVE-2025-3801\nCVE-2025-43970\nCVE-2025-43971\nCVE-2025-43972\nCVE-2025-43973\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"0b07f221-92ad-3b1f-a172-33635ea863f1","product":{"name":"govulncheck-vulndb-0.0.20250422T181640-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1a1c3148-3f34-3b7a-9147-c25eaa958c2b","product":{"name":"govulncheck-vulndb-0:0.0.20250422T181640-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"45a6771f-2c89-3e4b-a74d-e99249bed7dd","product":{"name":"govulncheck-vulndb-0.0.20250422T181640-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"54cdc794-11cc-3a0c-9698-bb7f7f211b2f","product":{"name":"govulncheck-vulndb-0.0.20250422T181640-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6e3940a1-cbff-38a3-8488-327e61e6e2f7","product":{"name":"govulncheck-vulndb-0.0.20250422T181640-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"7aafb140-707c-31ac-8136-d4c1cc34a8b9","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"a279aaab-df0d-389c-ac3d-36fd4cbacac0","product":{"name":"govulncheck-vulndb-0:0.0.20250422T181640-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"aeb659de-0ebb-3733-805b-162408d2268c","product":{"name":"govulncheck-vulndb-0:0.0.20250422T181640-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"bef05be2-6bd7-3cd6-a03a-98e6d46b6499","product":{"name":"govulncheck-vulndb-0:0.0.20250422T181640-1.1.s390x","vendor":{"name":"SUSE"}}}]}},{"id":"d55d37ba-6821-3db0-a125-621f8b61eb3b","advisory":{"id":"WID-SEC-W-2025-0579","description":"Mattermost Server: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Informationen offenzulegen.","datePublished":"Mar 17, 2025, 11:00:00 PM","dateUpdated":"Apr 22, 2025, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0579.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-0579\n","aliases":"CVE-2025-2475\nCVE-2025-32093\nCVE-2025-2424\nCVE-2025-24839\nCVE-2025-2564\nCVE-2025-27538\nCVE-2025-27571\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"12c9089f-66ac-3215-84d4-18df1ab42d4d","product":{"name":"Mattermost Mattermost Server 9.11.10","vendor":{"name":"Mattermost"}}},{"id":"131e2472-6e5c-397a-accb-2080ee2f5dc6","product":{"name":"Mattermost Mattermost Server 10.4.3","vendor":{"name":"Mattermost"}}},{"id":"1d25e669-b87b-3b16-81ef-084696a70139","product":{"name":"Mattermost Mattermost Server \u003c10.5.2","vendor":{"name":"Mattermost"}}},{"id":"1fab8467-8c7f-30a7-ad20-7c8b2ab2f44f","product":{"name":"Mattermost Mattermost Server 10.6.0","vendor":{"name":"Mattermost"}}},{"id":"2963b8ed-59a9-3469-895a-18cdf13d89a1","product":{"name":"Mattermost Mattermost Server 10.4.4","vendor":{"name":"Mattermost"}}},{"id":"2d95710b-0516-3612-947c-457ae6729fed","product":{"name":"Server 10.4.3","vendor":{"name":"Mattermost"}}},{"id":"2e3be2bd-e8b8-3bc1-afe2-2f161d7ae4f7","product":{"name":"Mattermost Mattermost Server 10.5.1","vendor":{"name":"Mattermost"}}},{"id":"38717597-6b95-348a-822c-8c9786454710","product":{"name":"Server 9.11.10","vendor":{"name":"Mattermost"}}},{"id":"4103102f-bf3f-3e45-bf9d-076500f7e7b2","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}}},{"id":"4290f19e-8c21-379b-8252-88cbc8138314","product":{"name":"Mattermost Mattermost Server \u003c10.4.3","vendor":{"name":"Mattermost"}}},{"id":"4d68792d-b4a6-31e2-bea4-a21458598756","product":{"name":"Mattermost Mattermost Server \u003c10.6.0","vendor":{"name":"Mattermost"}}},{"id":"73355c58-2e07-37b8-9638-01804e5c11bc","product":{"name":"Mattermost Mattermost Server \u003c10.5.1","vendor":{"name":"Mattermost"}}},{"id":"82426d65-27b3-3562-b509-c4485ab21fff","product":{"name":"Server 10.5.2","vendor":{"name":"Mattermost"}}},{"id":"84bdb44d-e526-3fdd-ade5-8a69489c2e9d","product":{"name":"Mattermost Mattermost Server 10.5.2","vendor":{"name":"Mattermost"}}},{"id":"8be4d2cf-7222-3cac-ba51-5b4f1860ccaa","product":{"name":"Mattermost Mattermost Server \u003c10.4.4","vendor":{"name":"Mattermost"}}},{"id":"a618c446-0bf5-3f07-945d-0f45a1097ce6","product":{"name":"Server 10.5.1","vendor":{"name":"Mattermost"}}},{"id":"aefdb77c-fc99-3b79-8b9b-2e770db40a9d","product":{"name":"Server 10.6.0","vendor":{"name":"Mattermost"}}},{"id":"e8e798af-1d41-3c28-ba40-3f412e3e2ac4","product":{"name":"Mattermost Mattermost Server \u003c9.11.10","vendor":{"name":"Mattermost"}}},{"id":"eba77661-9150-3468-9b70-d8edb9532b51","product":{"name":"Server 10.4.4","vendor":{"name":"Mattermost"}}}]}}]}