What is GHSA-xpg8-8xpv-948p?

GHSA-xpg8-8xpv-948p is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost does not enforce MFA on WebSocket connections

Which CVE IDs does GHSA-xpg8-8xpv-948p cover?

GHSA-xpg8-8xpv-948p covers the following CVE IDs: CVE-2025-55070. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xpg8-8xpv-948p?

GHSA-xpg8-8xpv-948p has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-xpg8-8xpv-948p?

GHSA-xpg8-8xpv-948p affects 2 products, including: go/github.com/mattermost/mattermost-server:\u003c 11.1.0; go/github.com/mattermost/mattermost/server/v8:\u003c 8.0.0-20250912063506-7d8b7b5e4a60.

GHSA-xpg8-8xpv-948pMediumCVSS 6.5

Mattermost does not enforce MFA on WebSocket connections

Vendor

GitHub Security Advisories

Published

November 14, 2025

Last Modified

November 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-55070 →

📋 Description

Mattermost versions < 11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events.

🎯 Affected products2

go/github.com/mattermost/mattermost-server:< 11.1.0
go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250912063506-7d8b7b5e4a60

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-55070
https://mattermost.com/security-updates
https://github.com/mattermost/mattermost/commit/7d8b7b5e4a6076b2f7c87606883c417f9a610df5
https://github.com/advisories/GHSA-xpg8-8xpv-948p