Skip to content
CVE PROGRAM SOURCE RECORD4.9 Medium

CVE-2025-11794

Password hash and MFA secret returned in user email verification endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 10.11.0 to ≤ 10.11.3affected
  • 10.5.0 to ≤ 10.5.11affected
  • 10.12.0 to ≤ 10.12.0affected
  • 11.0.0unaffected
  • 10.11.4unaffected
  • 10.5.12unaffected
  • 10.12.1unaffected

References