{"id":"EUVD-2025-186556","enisaUuid":"79673340-509c-3ac9-a56c-100151247e3c","description":"Mattermost versions \u003c11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events","datePublished":"Nov 14, 2025, 8:02:24 AM","dateUpdated":"Nov 14, 2025, 3:47:52 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-55070\nGHSA-xpg8-8xpv-948p\n","assigner":"Mattermost","epss":0.32,"enisaIdProduct":[{"id":"10017b87-35f0-38ca-8fbb-033ac2226474","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"\u003c11 ≤\u003c11"}],"enisaIdVendor":[{"id":"d2615bd8-5f2b-32ce-9ab9-1b3729b0664d","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"4a9c03f5-e72d-39b1-8115-1744f0664e2b","vulnerability":{"id":"CVE-2025-55070","description":"Mattermost versions \u003c11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events","datePublished":"Nov 14, 2025, 8:02:24 AM","dateUpdated":"Nov 14, 2025, 3:47:52 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-186556\n","assigner":"Mattermost","epss":0.32,"dataProcessed":"Nov 4, 2026, 7:12:36 AM","vulnerabilityProduct":[{"id":"308bcb99-bab4-3cf7-b053-44c02b66ea84","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"\u003c11 ≤\u003c11"}],"vulnerabilityVendor":[{"id":"6cc1e32b-26ba-35fc-a041-6b8cfaef12ee","vendor":{"name":"Mattermost"}}]}},{"id":"d73a55f9-b5c0-3fa3-97b5-68a4f46b863d","vulnerability":{"id":"GHSA-xpg8-8xpv-948p","description":"Mattermost does not enforce MFA on WebSocket connections","datePublished":"Nov 14, 2025, 9:30:27 AM","dateUpdated":"Nov 17, 2025, 1:41:39 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-55070\nhttps://github.com/mattermost/mattermost/commit/7d8b7b5e4a6076b2f7c87606883c417f9a610df5\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-186556\n","aliases":"CVE-2025-55070\nGHSA-xpg8-8xpv-948p\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}