6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6226

CVE-2025-6226: Mattermost Missing Authentication for Critical Function

Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6226

CVE-2025-6226:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.7	10.5.7
github.com/mattermost/mattermost-server	go	>= 10.8.0, < 10.8.2	10.8.2
github.com/mattermost/mattermost-server	go	>= 10.7.0, < 10.7.4	10.7.4
github.com/mattermost/mattermost-server	go	>= 9.11.0, < 9.11.17	9.11.17
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250520130510-fa40a8c5d47f	8.0.0-20250520130510-fa40a8c5d47f

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the deduplicateCreatePost function in server/channels/app/post.go. This function is responsible for handling post creation requests that include a PendingPostId to prevent duplicate posts. The vulnerability arises because the original implementation used the GetSinglePost function to retrieve the post associated with the PendingPostId from the cache. GetSinglePost does not perform any authorization checks, meaning any authenticated user could retrieve any post if they knew its PendingPostId, including posts in private channels they are not members of.

The patch addresses this by replacing the call to GetSinglePost with a call to GetPostIfAuthorized. This new function ensures that the user making the request has the necessary permissions to view the post before returning it. If the user is not authorized, the function now returns a 'forbidden' error, which is handled gracefully by logging a warning and treating the post as if it doesn't exist, thus preventing the information leak. The core of the vulnerability is the missing authorization check, which is fixed by introducing GetPostIfAuthorized within the deduplicateCreatePost logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.