CVE-2025-0503 LOW

CVE-2025-0503: Leaked User IDs and Metadata of Deleted DMs

Vendor Mattermost

Product Mattermost

Weakness CWE-754

Published February 14, 2025

Last update February 14, 2025

View on NVD All CVEs

CVSS base score

3.1/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

Key dates

02Disclosure timeline

February 14, 2025 CVE published

February 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0503 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/754.html

Related vulnerabilities

04Related CVE

CVE-2021-0281 Junos OS and Junos OS Evolved: Specific packets can trigger rpd crash when BGP Origin Validation is configured with RPKI CVE-2025-59960 Junos OS and Junos OS Evolved: DHCP Option 82 messages from clients being passed unmodified to the DHCP server CVE-2023-38069 CVE-2026-4054 SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service CVE-2023-49607 Playbook plugin crash via missing interface type assertion