{"id":"EUVD-2025-29164","enisaUuid":"f17cef09-bd31-32ef-9d9a-4b73a85a1fbe","description":"Mattermost versions 10.8.x \u003c\u003d 10.8.3, 10.5.x \u003c\u003d 10.5.8, 9.11.x \u003c\u003d 9.11.17, 10.10.x \u003c\u003d 10.10.1, 10.9.x \u003c\u003d 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing","datePublished":"Sep 15, 2025, 10:10:06 AM","dateUpdated":"Sep 15, 2025, 1:57:49 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-9078\nGHSA-9p92-x77w-9fw2\n","assigner":"Mattermost","epss":0.15,"enisaIdProduct":[{"id":"6e845ce9-4c27-320d-9171-445d859e2d86","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":""},{"id":"b1ed42f5-6cca-3a84-9137-9c7463a49b08","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.9.0 ≤10.9.3"},{"id":"dc794322-3f4b-31e9-abb1-3422bb6c0b0c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"},{"id":"f17e3d8f-c4a3-3b41-b582-838e63c45c21","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.10.0 ≤10.10.1"},{"id":"fb2fe9a5-226c-323a-bf6c-b6048944efad","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.8.0 ≤10.8.3"},{"id":"ff6589ec-ac92-3ed2-bea4-2e5095008acc","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"}],"enisaIdVendor":[{"id":"6e845ce9-4c27-320d-9171-445d859e2d86","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"1e002b84-e04e-3796-89bf-a149d50981ab","vulnerability":{"id":"CVE-2025-9078","description":"Mattermost versions 10.8.x \u003c\u003d 10.8.3, 10.5.x \u003c\u003d 10.5.8, 9.11.x \u003c\u003d 9.11.17, 10.10.x \u003c\u003d 10.10.1, 10.9.x \u003c\u003d 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing","datePublished":"Sep 15, 2025, 10:10:06 AM","dateUpdated":"Sep 15, 2025, 1:57:49 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-29164\n","assigner":"Mattermost","epss":0.15,"dataProcessed":"Nov 4, 2026, 7:15:08 AM","vulnerabilityProduct":[{"id":"0ab91da1-e3e1-4f7d-b7d7-f25696debf84","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.8.0 ≤10.8.3"},{"id":"4be07301-75b6-4ac7-a310-75c93301482e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"},{"id":"5fcad56f-d2b8-38de-afcb-a5852259a201","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.10.0 ≤10.10.1"},{"id":"60f5e090-d317-4495-bea4-47180fd76b64","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.9.0 ≤10.9.3"},{"id":"a4f62244-38e1-319a-8ac9-7fcb9ad2f551","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.9.0 ≤10.9.3"},{"id":"acf883dc-85f8-4289-a4f9-1d26730386a9","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.10.0 ≤10.10.1"},{"id":"b1356aa8-d6df-4851-9034-b5d40441acaa","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"cb895a57-fd8d-3452-a9ff-2d8bc6f09303","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":""},{"id":"f147a5a4-c5d2-3a9f-8e75-0a36ac1ac9b2","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"f68c13e6-e4fe-3048-b0e0-14b5a6eabf62","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"},{"id":"f6b239ef-d3aa-33d1-a039-59904b2245ac","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.8.0 ≤10.8.3"}],"vulnerabilityVendor":[{"id":"cb895a57-fd8d-3452-a9ff-2d8bc6f09303","vendor":{"name":"Mattermost"}}]}},{"id":"995f4727-4b3b-31ad-992c-039d325c3769","vulnerability":{"id":"GHSA-9p92-x77w-9fw2","description":"Mattermost makes Use of Weak Hash","datePublished":"Sep 15, 2025, 12:31:25 PM","dateUpdated":"Sep 16, 2025, 7:13:08 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-9078\nhttps://github.com/mattermost/mattermost/commit/356880c8430b77a4a390c89d5a33f6928188d137\nhttps://github.com/mattermost/mattermost/commit/944ad5cdd9876ef61c78c8275906262a4118755a\nhttps://github.com/mattermost/mattermost/commit/a8a4badc130be101e5bc4b7916bbcd2f966c4b79\nhttps://github.com/mattermost/mattermost/commit/cd87e5c877373f109742aa90a3fa136c14774325\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-29164\n","aliases":"CVE-2025-9078\nGHSA-9p92-x77w-9fw2\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:12:52 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"c0197c72-fdfc-3dfb-9f06-d4a6583b789f","advisory":{"id":"openSUSE-SU-2025:15564-1","description":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media","datePublished":"Sep 18, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:42:03 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15564-1.json\nhttps://www.suse.com/security/cve/CVE-2025-4953/\nhttps://www.suse.com/security/cve/CVE-2025-54123/\nhttps://www.suse.com/security/cve/CVE-2025-54376/\nhttps://www.suse.com/security/cve/CVE-2025-58058/\nhttps://www.suse.com/security/cve/CVE-2025-58063/\nhttps://www.suse.com/security/cve/CVE-2025-58157/\nhttps://www.suse.com/security/cve/CVE-2025-58158/\nhttps://www.suse.com/security/cve/CVE-2025-58430/\nhttps://www.suse.com/security/cve/CVE-2025-58437/\nhttps://www.suse.com/security/cve/CVE-2025-58445/\nhttps://www.suse.com/security/cve/CVE-2025-58450/\nhttps://www.suse.com/security/cve/CVE-2025-59358/\nhttps://www.suse.com/security/cve/CVE-2025-59359/\nhttps://www.suse.com/security/cve/CVE-2025-59360/\nhttps://www.suse.com/security/cve/CVE-2025-59361/\nhttps://www.suse.com/security/cve/CVE-2025-7445/\nhttps://www.suse.com/security/cve/CVE-2025-8396/\nhttps://www.suse.com/security/cve/CVE-2025-9072/\nhttps://www.suse.com/security/cve/CVE-2025-9076/\nhttps://www.suse.com/security/cve/CVE-2025-9078/\nhttps://www.suse.com/security/cve/CVE-2025-9084/\n","aliases":"CVE-2025-4953\nCVE-2025-54123\nCVE-2025-54376\nCVE-2025-58058\nCVE-2025-58063\nCVE-2025-58157\nCVE-2025-58158\nCVE-2025-58430\nCVE-2025-58437\nCVE-2025-58445\nCVE-2025-58450\nCVE-2025-59358\nCVE-2025-59359\nCVE-2025-59360\nCVE-2025-59361\nCVE-2025-7445\nCVE-2025-8396\nCVE-2025-9072\nCVE-2025-9076\nCVE-2025-9078\nCVE-2025-9084\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1cc76f98-371a-3fc6-aee6-5eadf51878a2","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"29107cb4-f129-3481-ac9b-db60712e7317","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"29cdf64b-9d51-3131-8329-d2fe15008bbb","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"2e830e5b-5857-3f97-a80c-b3a30b97b6c2","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"610e85a2-a76d-3b52-ae27-3bf4aba41ec0","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"736c93eb-17d0-3c0d-9744-877b4b8ffc8d","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ea17cf9d-e8f0-3a74-b23c-845080a781c5","product":{"name":"govulncheck-vulndb-0:0.0.20250917T170349-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fb90779c-62f0-353d-b846-d907b8a69a19","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ff6a651c-8c7a-3ba4-be7f-c1564c968489","product":{"name":"govulncheck-vulndb-0.0.20250917T170349-1.1.s390x","vendor":{"name":"SUSE"}}}]}}]}