{"id":"GHSA-gmx5-frv9-9m9f","revision":"d20f1babc7cc4bbca4fe282046ee7d64","records":[{"revision":"d20f1babc7cc4bbca4fe282046ee7d64","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-gmx5-frv9-9m9f","aliases":["CVE-2025-62190","GO-2025-4254"],"title":"Mattermost has CSRF vulnerability via Calls Widget page","description":"Mattermost versions 11.0.x < 11.0.4, 10.12.x <= 10.12.2, 10.11.x < 10.11.6 and Mattermost Calls versions < 1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link.","state":0,"publishedAt":"2025-12-17T15:34:53+00:00","modifiedAt":"2025-12-30T02:25:54.360006+00:00","affected":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-plugin-calls","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.10.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-62190","https://github.com/mattermost/mattermost-plugin-calls/commit/429cfaf2a301a369414d1ca18a3364e85901c8d1","https://github.com/mattermost/mattermost-plugin-calls","https://github.com/mattermost/mattermost-plugin-calls/releases/tag/v1.10.0","https://mattermost.com/security-updates"],"sourceUrl":"https://github.com/advisories/GHSA-gmx5-frv9-9m9f","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gmx5-frv9-9m9f","identifiers":["GHSA-gmx5-frv9-9m9f","CVE-2025-62190","GO-2025-4254"]},"retained":false,"historicalAffected":[]}],"coverage":[]}