Go/github.com/mattermost/mattermost/server/v8 CVE-2025-55073: medium 5.3, EPSS 0.20%

Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20250929212932-a41db04d2746 or later.

go get github.com/mattermost/mattermost/server/v8@v8.0.0-20250929212932-a41db04d2746

Affected

Fixed versions

Sources

• osv: GO-2025-4129#Go/github.com/mattermost/mattermost/server/v8
• nvd: CVE-2025-55073
• https://github.com/advisories/GHSA-ff85-qw3h-g9vp
• https://github.com/mattermost/mattermost/commit/375ce229f4923205394d8f27925372b2cbf28130
• https://github.com/mattermost/mattermost/commit/6c288aa62bb3343183ec1d0a06360d14aa0193e9
• https://github.com/mattermost/mattermost/commit/a41db04d2746ab549d056db4ede4cd803f64989c
• https://github.com/mattermost/mattermost/commit/b822cea06bf5683a176e2c92711241bd29cd9389
• https://github.com/mattermost/mattermost/commit/e47349ea0fc072ee1dfb196d9bb1c8fd1a589224
• https://mattermost.com/security-updates

CVE-2025-55073 · published 2025-11-18T15:34:32Z · modified 2026-03-03T04:57:38.168670Z · JSON