{"id":"EUVD-2025-198045","enisaUuid":"a369c04d-0dc7-3be1-a9a7-b874998f8ced","description":"Mattermost versions 10.11.x \u003c\u003d 10.11.3, 10.5.x \u003c\u003d 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects","datePublished":"Nov 18, 2025, 3:23:29 PM","dateUpdated":"Nov 18, 2025, 9:03:22 PM","baseScore":3.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-55074\nGHSA-9hh7-6558-qfp2\n","assigner":"Mattermost","epss":0.18,"enisaIdProduct":[{"id":"7392cfd2-5114-3e87-bae1-de5119d573c3","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.11"},{"id":"e0994cce-bc28-3e86-a8b6-ba5336ea475f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.3"}],"enisaIdVendor":[{"id":"d9b7590a-814b-3b90-bbcd-e12ced548844","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"4381e4fc-0d7f-3a10-a0f9-f0326e3f1b45","vulnerability":{"id":"CVE-2025-55074","description":"Mattermost versions 10.11.x \u003c\u003d 10.11.3, 10.5.x \u003c\u003d 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects","datePublished":"Nov 18, 2025, 3:23:29 PM","dateUpdated":"Nov 18, 2025, 9:03:22 PM","status":"PUBLISHED","baseScore":3.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-198045\n","assigner":"Mattermost","epss":0.18,"dataProcessed":"Oct 29, 2026, 7:12:57 AM","vulnerabilityProduct":[{"id":"b3583722-fc57-3303-869b-c7ccf1ae4574","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.3"},{"id":"d9a0cc68-051c-391f-928b-abebdb6b2aa2","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.11"}],"vulnerabilityVendor":[{"id":"ccbee4be-aa05-3794-b7c3-54208276889d","vendor":{"name":"Mattermost"}}]}},{"id":"50dbbbfc-8f66-362b-8af7-94f59d0d6b04","vulnerability":{"id":"GHSA-9hh7-6558-qfp2","description":"Mattermost allows other users to determine when users had read channels via channel member objects","datePublished":"Nov 18, 2025, 6:32:52 PM","dateUpdated":"Nov 27, 2025, 8:34:12 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-55074\nhttps://github.com/mattermost/mattermost/pull/33835\nhttps://github.com/mattermost/mattermost/pull/33905\nhttps://github.com/mattermost/mattermost/commit/98acefe911dd9de7edf47a7d825dd99f53141a52\nhttps://github.com/mattermost/mattermost/commit/ba86dfc5876b354b9d3c20ff45c08ca6f8426149\nhttps://github.com/mattermost/mattermost/commit/d72d437f1567ba0b639b6e4fd73bab06c51baab5\nhttps://github.com/advisories/GHSA-9hh7-6558-qfp2\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-198045\n","aliases":"GHSA-9hh7-6558-qfp2\nCVE-2025-55074\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}