CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.5. Exploitation may require the attacker to be authenticated.
CVE
CVE-2025-6226
Severity
MEDIUM
CVSS
6.5
EPSS
0.31%
Original NVD Description
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
Related CVEs
Other vulnerabilities affecting the same vendor(s)