{"id":"EUVD-2025-30247","enisaUuid":"e21bc548-1323-363d-93b0-17fb85f3e6c2","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.8, 9.11.x \u003c\u003d 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration","datePublished":"Sep 19, 2025, 7:36:14 PM","dateUpdated":"Sep 19, 2025, 7:52:03 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2025-9081\nGHSA-f72g-52v7-mg3p\n","assigner":"Mattermost","epss":0.28,"enisaIdProduct":[{"id":"15b7fac2-8cc0-3ccb-ba82-d7c7777fd83e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"7ead02ce-16db-3af9-bace-481808539cd4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":""},{"id":"8010fb6d-0f1a-35f9-be56-0a9747ed6867","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"}],"enisaIdVendor":[{"id":"7ead02ce-16db-3af9-bace-481808539cd4","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"9c20cfa7-dc12-390f-bab2-5639bee8ebbb","vulnerability":{"id":"CVE-2025-9081","description":"Mattermost versions 10.5.x \u003c\u003d 10.5.8, 9.11.x \u003c\u003d 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration","datePublished":"Sep 19, 2025, 7:36:14 PM","dateUpdated":"Sep 19, 2025, 7:52:03 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2025-30247\n","assigner":"Mattermost","epss":0.28,"dataProcessed":"Nov 6, 2026, 7:16:38 AM","vulnerabilityProduct":[{"id":"3339d69a-30ee-48f3-b0b6-51cdd3049542","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"},{"id":"5c00386f-7bcb-3117-a0e5-6c60ede15906","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":""},{"id":"b12e0c87-2d24-3f5d-937e-5a286d368e14","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"bae42c59-cba6-4793-9b82-0e69dfde4ca4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"9.11.0 ≤9.11.17"},{"id":"ed2bf6d2-2ab6-31ec-b719-ccc291026c2d","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.5.0 ≤10.5.8"}],"vulnerabilityVendor":[{"id":"5c00386f-7bcb-3117-a0e5-6c60ede15906","vendor":{"name":"Mattermost"}}]}},{"id":"e971c32e-5f79-3616-8c39-8718134d7f32","vulnerability":{"id":"GHSA-f72g-52v7-mg3p","description":"Mattermost boards plugin fails to restrict download access to files","datePublished":"Sep 19, 2025, 9:31:21 PM","dateUpdated":"Sep 26, 2025, 4:23:18 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-9081\nhttps://github.com/mattermost/mattermost-plugin-boards/pull/114\nhttps://github.com/mattermost/mattermost-plugin-boards/commit/3f3e3becfe1d66db0d0f4fd235f04afd6e1ec40b\nhttps://github.com/mattermost/mattermost-plugin-boards\nhttps://mattermost.com/security-updates\nhttps://pkg.go.dev/vuln/GO-2025-3978\n","enisa_id":"EUVD-2025-30247\n","aliases":"CVE-2025-9081\nGHSA-f72g-52v7-mg3p\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:13:00 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"02900413-3de7-348b-ba6d-eedd3ec1cdc9","advisory":{"id":"openSUSE-SU-2025:15576-1","description":"govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media","datePublished":"Sep 25, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:42:15 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15576-1.json\nhttps://www.suse.com/security/cve/CVE-2025-10630/\nhttps://www.suse.com/security/cve/CVE-2025-59341/\nhttps://www.suse.com/security/cve/CVE-2025-59342/\nhttps://www.suse.com/security/cve/CVE-2025-59345/\nhttps://www.suse.com/security/cve/CVE-2025-59346/\nhttps://www.suse.com/security/cve/CVE-2025-59347/\nhttps://www.suse.com/security/cve/CVE-2025-59348/\nhttps://www.suse.com/security/cve/CVE-2025-59349/\nhttps://www.suse.com/security/cve/CVE-2025-59350/\nhttps://www.suse.com/security/cve/CVE-2025-59351/\nhttps://www.suse.com/security/cve/CVE-2025-59352/\nhttps://www.suse.com/security/cve/CVE-2025-59353/\nhttps://www.suse.com/security/cve/CVE-2025-59354/\nhttps://www.suse.com/security/cve/CVE-2025-59410/\nhttps://www.suse.com/security/cve/CVE-2025-9079/\nhttps://www.suse.com/security/cve/CVE-2025-9081/\n","aliases":"CVE-2025-10630\nCVE-2025-59341\nCVE-2025-59342\nCVE-2025-59345\nCVE-2025-59346\nCVE-2025-59347\nCVE-2025-59348\nCVE-2025-59349\nCVE-2025-59350\nCVE-2025-59351\nCVE-2025-59352\nCVE-2025-59353\nCVE-2025-59354\nCVE-2025-59410\nCVE-2025-9079\nCVE-2025-9081\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"00214a2d-9bbd-31ea-a4fb-684ec2ff20d5","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"0cce59cf-569b-3ece-92b4-dd55f5b819a0","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1bff9a38-13c6-39a2-9eb6-176e1445f406","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"336a9cde-230f-302f-8ec2-8cd30fab322f","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5c801d8c-6101-3ed7-a4a3-2cb1b3edf770","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"af4d3cd0-e6bb-381b-985e-56153abf8c49","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"ca324835-c24c-3355-96a7-d8fb95f68e90","product":{"name":"govulncheck-vulndb-0:0.0.20250924T192141-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cfaf5451-3210-392e-b392-fde4ccb0ab2b","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ddb36019-723e-3336-805f-e23ace80eaec","product":{"name":"govulncheck-vulndb-0.0.20250924T192141-1.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}