{"id":"EUVD-2025-197607","enisaUuid":"7a0f5ab0-50f5-321b-b0fc-7952cd9beb01","description":"Mattermost versions 10.11.x \u003c\u003d 10.11.3, 10.5.x \u003c\u003d 10.5.11, 10.12.x \u003c\u003d 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint","datePublished":"Nov 14, 2025, 10:45:39 AM","dateUpdated":"Dec 1, 2025, 3:36:58 PM","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-11794\nGHSA-mqp8-pgg5-7x7m\n","assigner":"Mattermost","epss":0.3,"enisaIdProduct":[{"id":"73356079-8392-346c-9e8d-6fb64149b42c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.0"},{"id":"79ff63f6-4926-3e28-9a7f-d890b4c13133","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.3"},{"id":"a6e4d15c-676c-3a1a-9642-7b73388c85c2","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.11"}],"enisaIdVendor":[{"id":"4fcc477b-c452-39fc-b138-b32272d9be1b","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"87918c0b-daea-3398-ae37-6bb46a53782c","vulnerability":{"id":"CVE-2025-11794","description":"Mattermost versions 10.11.x \u003c\u003d 10.11.3, 10.5.x \u003c\u003d 10.5.11, 10.12.x \u003c\u003d 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint","datePublished":"Nov 14, 2025, 10:45:39 AM","dateUpdated":"Dec 1, 2025, 3:36:58 PM","status":"PUBLISHED","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-197607\n","assigner":"Mattermost","epss":0.3,"dataProcessed":"Nov 6, 2026, 7:17:15 AM","vulnerabilityProduct":[{"id":"44324158-3d7b-3ba7-89f0-41e30136414b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.3"},{"id":"7b879461-c545-3c33-a30c-278c3d1469ee","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.0"},{"id":"d8b1f330-33d1-36ad-b261-5d678f53ab81","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.11"}],"vulnerabilityVendor":[{"id":"f58bf9e3-58e4-340b-b5c5-38270061d391","vendor":{"name":"Mattermost"}}]}},{"id":"9a3c1461-c5e0-3d90-accb-9d8b86909ba0","vulnerability":{"id":"GHSA-mqp8-pgg5-7x7m","description":"Mattermost allows system administrators to access password hashes and MFA secrets","datePublished":"Nov 14, 2025, 12:30:18 PM","dateUpdated":"Nov 17, 2025, 5:58:51 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-11794\nhttps://github.com/mattermost/mattermost/commit/375ce229f4923205394d8f27925372b2cbf28130\nhttps://github.com/mattermost/mattermost/commit/6c288aa62bb3343183ec1d0a06360d14aa0193e9\nhttps://github.com/mattermost/mattermost/commit/a41db04d2746ab549d056db4ede4cd803f64989c\nhttps://github.com/mattermost/mattermost/commit/b822cea06bf5683a176e2c92711241bd29cd9389\nhttps://github.com/mattermost/mattermost/commit/e47349ea0fc072ee1dfb196d9bb1c8fd1a589224\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-197607\n","aliases":"GHSA-mqp8-pgg5-7x7m\nCVE-2025-11794\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}