CVE-2025-20033

Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.

Published: Jan 9, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-20033
GHSA: GHSA-2549-xh72-qrpm
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWEs:

CWE-1287

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.16
github.com/mattermost/mattermost/server/v8	10.0.0	10.0.4
github.com/mattermost/mattermost/server/v8	10.1.0	10.1.4
github.com/mattermost/mattermost/server/v8	10.2.0	10.2.0.x
github.com/mattermost/mattermost/server/v8	10.2.0	10.2.1
github.com/mattermost/mattermost/server/v8	-	8.0.0-20250102081831-64c566a8280b

https://mattermost.com/security-updates

Vulnerability Database

CVE-2025-20033

Deep Security Visibility Without the Complexity