{"id":"GHSA-f72g-52v7-mg3p","revision":"4d7ac625470440a49b887101de08cd3d","records":[{"revision":"4d7ac625470440a49b887101de08cd3d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-f72g-52v7-mg3p","aliases":["CVE-2025-9081","GO-2025-3978"],"title":"Mattermost boards plugin fails to restrict download access to files","description":"Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration","state":0,"publishedAt":"2025-09-19T21:31:21+00:00","modifiedAt":"2025-09-26T16:23:18+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-plugin-boards","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20250716054606-3f3e3becfe1d"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.0.0-20250721095935-11c36f4d1e44"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.5.0-rc1"},{"kind":"fixed","version":"10.5.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"9.11.0-rc1"},{"kind":"fixed","version":"9.11.18"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-9081","https://github.com/mattermost/mattermost-plugin-boards/pull/114","https://github.com/mattermost/mattermost-plugin-boards/commit/3f3e3becfe1d66db0d0f4fd235f04afd6e1ec40b","https://github.com/mattermost/mattermost-plugin-boards","https://mattermost.com/security-updates","https://pkg.go.dev/vuln/GO-2025-3978"],"sourceUrl":"https://github.com/advisories/GHSA-f72g-52v7-mg3p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f72g-52v7-mg3p","identifiers":["GHSA-f72g-52v7-mg3p","CVE-2025-9081","GO-2025-3978"]},"retained":false,"historicalAffected":[]}],"coverage":[]}