{"id":"EUVD-2025-199831","enisaUuid":"5b2ffb34-aa12-365d-b273-d936213fa455","description":"Mattermost versions 11.0.x \u003c\u003d 11.0.2, 10.12.x \u003c\u003d 10.12.1, 10.11.x \u003c\u003d 10.11.4, 10.5.x \u003c\u003d 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint","datePublished":"Nov 27, 2025, 4:36:30 PM","dateUpdated":"Nov 28, 2025, 3:20:44 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-12559\nGHSA-4g87-9x45-cx2h\n","assigner":"Mattermost","epss":0.23,"enisaIdProduct":[{"id":"6770f2a7-5f14-342f-8a1c-c5a8281b56e9","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.4"},{"id":"81ebb957-80bb-3846-9530-6494d050ffbb","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.12"},{"id":"b5e4a63a-c701-37c4-ad70-dd7f939d404a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.1"},{"id":"d0259f36-b699-3ef7-840f-551196bd6a7e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.2"}],"enisaIdVendor":[{"id":"a028ed68-14e1-3afe-b27b-0309fd5dcdda","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"0d3750de-d71d-3350-be9f-c3d7e492071f","vulnerability":{"id":"GHSA-4g87-9x45-cx2h","description":"Mattermost fails to sanitize team email addresses","datePublished":"Nov 27, 2025, 6:30:25 PM","dateUpdated":"Dec 1, 2025, 11:57:02 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-12559\nhttps://github.com/mattermost/mattermost/pull/34110\nhttps://github.com/mattermost/mattermost/commit/5d8719042c1807da59ac8a821624eb01152d8495\nhttps://github.com/mattermost/mattermost/commit/649aee8fa9184ca59bd66022a33b8f8918e413aa\nhttps://github.com/mattermost/mattermost/commit/7ccb62db7958abd6a4b21a06c5a4f5367a8f8b1f\nhttps://github.com/mattermost/mattermost/commit/9f54e5cdc3aef412945ff0e6a58338f7b549bdda\nhttps://github.com/mattermost/mattermost/commit/abbf01b9db45d1850eaf3701ea8362b910193ffd\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-199831\n","aliases":"GHSA-4g87-9x45-cx2h\nCVE-2025-12559\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8663a773-fa95-3125-bb3f-a063d4d51d94","vulnerability":{"id":"CVE-2025-12559","description":"Mattermost versions 11.0.x \u003c\u003d 11.0.2, 10.12.x \u003c\u003d 10.12.1, 10.11.x \u003c\u003d 10.11.4, 10.5.x \u003c\u003d 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint","datePublished":"Nov 27, 2025, 4:36:30 PM","dateUpdated":"Nov 28, 2025, 3:20:44 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-199831\n","assigner":"Mattermost","epss":0.23,"dataProcessed":"Nov 6, 2026, 7:17:28 AM","vulnerabilityProduct":[{"id":"4cc09600-b418-3719-bad6-dd12306db10a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.4"},{"id":"552d4b51-76e3-3def-a7d7-44ca198fe41f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.2"},{"id":"b50dbca1-c29c-310f-96fa-d64fec93dcfe","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.12"},{"id":"e567ed8f-7b54-3b86-b1ed-ef9d751cabb0","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.1"}],"vulnerabilityVendor":[{"id":"4259749e-c4ce-31cd-b472-c33df15c3f03","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}