CVE-2025-47700

AI plugin APIs can be triggered using post actions

State: Published
Severity: 3.5 Low
Published: Aug 21, 2025
Updated: Aug 21, 2025
Reserved: Jul 22, 2025

Description

Mattermost Server versions 10.5.x <= 10.5.9 utilizing the Agents plugin fail to reject empty request bodies which allows users to trick users into clicking malicious links via post actions

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N	Mattermost

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
MattermostMattermost	10.10.0Not affected 10.5.9Not affected 10.5.0 through 10.5.8Affected

References

https://mattermost.com/security-updates

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.