{"id":"EUVD-2025-198045","enisaUuid":"a369c04d-0dc7-3be1-a9a7-b874998f8ced","description":"Mattermost versions 10.11.x \u003c\u003d 10.11.3, 10.5.x \u003c\u003d 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects","datePublished":"Nov 18, 2025, 3:23:29 PM","dateUpdated":"Nov 18, 2025, 9:03:22 PM","baseScore":3.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-55074\nGHSA-9hh7-6558-qfp2\n","assigner":"Mattermost","epss":0.18,"enisaIdProduct":[{"id":"7392cfd2-5114-3e87-bae1-de5119d573c3","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.11"},{"id":"e0994cce-bc28-3e86-a8b6-ba5336ea475f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.3"}],"enisaIdVendor":[{"id":"d9b7590a-814b-3b90-bbcd-e12ced548844","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"4381e4fc-0d7f-3a10-a0f9-f0326e3f1b45","vulnerability":{"id":"CVE-2025-55074","description":"Mattermost versions 10.11.x \u003c\u003d 10.11.3, 10.5.x \u003c\u003d 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects","datePublished":"Nov 18, 2025, 3:23:29 PM","dateUpdated":"Nov 18, 2025, 9:03:22 PM","status":"PUBLISHED","baseScore":3.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-198045\n","assigner":"Mattermost","epss":0.18,"dataProcessed":"Nov 6, 2026, 7:13:53 AM","vulnerabilityProduct":[{"id":"b3583722-fc57-3303-869b-c7ccf1ae4574","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.3"},{"id":"d9a0cc68-051c-391f-928b-abebdb6b2aa2","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.11"}],"vulnerabilityVendor":[{"id":"ccbee4be-aa05-3794-b7c3-54208276889d","vendor":{"name":"Mattermost"}}]}},{"id":"50dbbbfc-8f66-362b-8af7-94f59d0d6b04","vulnerability":{"id":"GHSA-9hh7-6558-qfp2","description":"Mattermost allows other users to determine when users had read channels via channel member objects","datePublished":"Nov 18, 2025, 6:32:52 PM","dateUpdated":"Nov 27, 2025, 8:34:12 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-55074\nhttps://github.com/mattermost/mattermost/pull/33835\nhttps://github.com/mattermost/mattermost/pull/33905\nhttps://github.com/mattermost/mattermost/commit/98acefe911dd9de7edf47a7d825dd99f53141a52\nhttps://github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149\nhttps://github.com/mattermost/mattermost/commit/d72d437f1567ba0b639b6e4fd73bab06c51baab5\nhttps://github.com/advisories/GHSA-9hh7-6558-qfp2\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-198045\n","aliases":"GHSA-9hh7-6558-qfp2\nCVE-2025-55074\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}