CVE-2025-9081

IDOR in board file download allows any user to download any file by UUID

State: Published
Severity: 3.1 Low
Published: Sep 19, 2025
Updated: Sep 19, 2025
Reserved: Aug 15, 2025

Description

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	Mattermost

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
MattermostMattermost	10.5.0 through 10.5.8Affected 9.11.0 through 9.11.17Affected 10.11.0Not affected 10.5.9Not affected 9.11.18Not affected

References

https://mattermost.com/security-updates

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.