Launch Week Day 1: Announcing Security Design Review
MEDIUM 4.3 Go

Mattermost fails to validate user permissions when deleting comments in Boards

GHSA-p6gj-jc38-x2m7 · CVE-2025-12756 · GO-2025-4172

Published · Modified

Description

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.

Ready to move

Start Securing

Free, no credit card | First findings in minutes