4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62190

CVE-2025-62190: CSRF Allows Call Initiation and Message Delivery

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62190

CVE-2025-62190:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-plugin-calls	go	< 1.10.0	1.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) on the Mattermost Calls widget page, identified as CVE-2025-62190. The analysis of the fixing commit 429cfaf2a301a369414d1ca18a3364e85901c8d1 reveals that the vulnerability lies in the handleServeStandalone function within server/api.go. This function is responsible for serving the standalone widget's HTML page. The patch introduces Referrer-based CSRF protection to this function. Previously, the absence of such a check allowed an attacker to embed or link to the widget URL from an external malicious website. When an authenticated user visited this malicious site, their browser would automatically send a request to the widget endpoint, leading to unauthorized actions being performed on their behalf, such as initiating calls or sending messages. The added code explicitly checks if the request's 'Referer' header matches the application's host, thus ensuring the request originates from a legitimate context and preventing the CSRF attack.

Vulnerable functions

Plugin.handleServeStandalone

server/api.go

This function serves the standalone calls widget. Before the patch, it lacked CSRF protection, allowing an attacker to force a user's browser to make a request to this endpoint from a malicious site. This could trigger actions like starting a call or posting messages within Mattermost on behalf of the authenticated user. The patch adds a Referrer header check to mitigate this CSRF vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.