{"id":"EUVD-2025-203892","revision":"3135224f4dde494990a824d943e8fe49","records":[{"revision":"3135224f4dde494990a824d943e8fe49","observedAt":"2026-11-05T02:54:56.58+00:00","statement":{"source":"euvd","id":"EUVD-2025-203892","aliases":["CVE-2025-62190","GHSA-gmx5-frv9-9m9f"],"title":"Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inje…","description":"Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3,"severity":null}],"references":["https://mattermost.com/security-updates"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203892","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 17, 2025, 12:07:37 PM","dateUpdated":"Dec 17, 2025, 3:47:20 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203892","identifiers":["EUVD-2025-203892","CVE-2025-62190","GHSA-gmx5-frv9-9m9f"]},"retained":false,"historicalAffected":[]}],"coverage":[]}