tocsin

Go/github.com/mattermost/mattermost-server CVE-2025-55073: medium 5.3, EPSS 0.20%

Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 10.5.12+incompatible or later.

go get github.com/mattermost/mattermost-server@v10.5.12+incompatible
go get github.com/mattermost/mattermost-server@v10.11.4+incompatible
go get github.com/mattermost/mattermost-server@v10.12.1+incompatible

Affected

introducedfixedlast affected
10.5.0+incompatible10.5.12+incompatible-
10.11.0+incompatible10.11.4+incompatible-
10.12.0+incompatible10.12.1+incompatible-

Fixed versions

10.5.12+incompatible10.11.4+incompatible10.12.1+incompatible

Sources

CVE-2025-55073 · published · modified · JSON