GHSA-p6gj-jc38-x2m7MediumCVSS 4.3

Mattermost fails to validate user permissions when deleting comments in Boards

Published
December 1, 2025
Last Modified
December 2, 2025

🔗 CVE IDs covered (1)

CVE-2025-12756 →

📋 Description

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

🎯 Affected products5

  • go/github.com/mattermost/mattermost/server/v8:<= 8.0.0-20251013062617-7977e7e6dae3
  • go/github.com/mattermost/mattermost:>= 10.11.0, <= 10.11.4
  • go/github.com/mattermost/mattermost:>= 10.12.0, <= 10.12.1
  • go/github.com/mattermost/mattermost:>= 10.5.0, <= 10.5.12
  • go/github.com/mattermost/mattermost:>= 11.0.0, <= 11.0.2

🔗 References (3)