Skip to content
CVE PROGRAM SOURCE RECORD2.2 Low

CVE-2025-27538

MFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 10.5.0 to ≤ 10.5.1affected
  • 9.11.0 to ≤ 9.11.9affected
  • 10.6.0unaffected
  • 10.5.2unaffected
  • 9.11.10unaffected

References