{"id":"EUVD-2025-203892","enisaUuid":"47b3b0a8-457e-3987-beaf-1a05378c82bf","description":"Mattermost versions 11.0.x \u003c\u003d 11.0.4, 10.12.x \u003c\u003d 10.12.2, 10.11.x \u003c\u003d 10.11.6 and Mattermost Calls versions \u003c\u003d1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link","datePublished":"Dec 17, 2025, 12:07:37 PM","dateUpdated":"Dec 17, 2025, 3:47:20 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-62190\nGHSA-gmx5-frv9-9m9f\n","assigner":"Mattermost","epss":0.12,"enisaIdProduct":[{"id":"09e14560-e634-33e3-b68e-e9831d85ac8a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.6"},{"id":"83941bbe-2fc6-37d9-b313-8afb9c87837f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.4"},{"id":"c0c2c293-eeec-3b1c-a8ab-fc8ded8a362e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.2"}],"enisaIdVendor":[{"id":"9c642b95-4b20-3371-9d41-7acb8ecd7c3f","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"04efd56d-cd39-368b-a2db-4b815ef1f4f3","vulnerability":{"id":"CVE-2025-62190","description":"Mattermost versions 11.0.x \u003c\u003d 11.0.4, 10.12.x \u003c\u003d 10.12.2, 10.11.x \u003c\u003d 10.11.6 and Mattermost Calls versions \u003c\u003d1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link","datePublished":"Dec 17, 2025, 12:07:37 PM","dateUpdated":"Dec 17, 2025, 3:47:20 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-203892\n","assigner":"Mattermost","epss":0.12,"dataProcessed":"Nov 8, 2026, 7:19:59 AM","vulnerabilityProduct":[{"id":"006f6e8b-ff75-3dfd-965c-19092dad474a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.12.0 ≤10.12.2"},{"id":"7f2140fe-d93f-32c1-841f-e6e67cb92f7d","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.0.0 ≤11.0.4"},{"id":"c1e351c1-4004-3717-979f-2ae2f594bf61","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.6"}],"vulnerabilityVendor":[{"id":"ac4ab2f6-2ee0-3e08-9f1e-90d7f7601ac3","vendor":{"name":"Mattermost"}}]}},{"id":"8fc9aaba-42ea-34e9-acf6-376c73c560da","vulnerability":{"id":"GHSA-gmx5-frv9-9m9f","description":"Mattermost has CSRF vulnerability via Calls Widget page","datePublished":"Dec 17, 2025, 3:34:53 PM","dateUpdated":"Dec 20, 2025, 5:10:29 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-62190\nhttps://github.com/mattermost/mattermost-plugin-calls/commit/429cfaf2a301a369414d1ca18a3364e85901c8d1\nhttps://github.com/mattermost/mattermost-plugin-calls\nhttps://github.com/mattermost/mattermost-plugin-calls/releases/tag/v1.10.0\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-203892\n","aliases":"GHSA-gmx5-frv9-9m9f\nCVE-2025-62190\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}