Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-55070

Good to know:

icon
icon

Date: November 14, 2025

Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-55070
https://github.com/mattermost/mattermost
https://github.com/mattermost/mattermost/commit/7d8b7b5e4a6076b2f7c87606883c417f9a610df5
https://github.com/advisories/GHSA-xpg8-8xpv-948p
https://mattermost.com/security-updates
https://www.mend.io/vulnerability-database/CVE-2025-55070

Severity Score

Weakness Type (CWE)

Missing Authentication for Critical Function

CWE-306

Top Fix

icon

Upgrade Version

Upgrade to version github.com/mattermost/mattermost - v11.0.0;github.com/mattermost/mattermost-server - v11.1.0;github.com/mattermost/mattermost-server - v11.1.0+incompatible;github.com/mattermost/mattermost/server/v8 - v8.0.0-20250912063506-7d8b7b5e4a60

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us