3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49810

CVE-2025-49810: Mattermost Lack of Access Control Validation

Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49810

CVE-2025-49810:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.5.0, <= 10.5.8	10.5.9
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250721095846-c602a4a78e1f	8.0.0-20250721095846-c602a4a78e1f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the bulk import functionality of Mattermost, specifically in how it handles thread followers for imported posts. The advisory mentions a 'Lack of Access Control Validation', and the patch analysis confirms this. The functions ValidatePostImportData and ValidateDirectPostImportData in server/channels/app/imports/import_validators.go were not validating the ThreadFollowers field in the import data. This allowed an attacker to add themselves as a follower to any thread, including those in private channels or direct messages they are not a part of. The fix introduces a new function, ValidateThreadFollowerImportData, and calls it from the two vulnerable functions to ensure that the user being added as a follower is valid. The vulnerability could be exploited by crafting a malicious bulk import file and using the import feature, which could be triggered by an AI post or other means.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.