CVE-2025-0503

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-754

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-05045.4Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Man CVE-2025-050510.0On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on CVE-2025-05065.4The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag param CVE-2025-05076.4The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes CVE-2025-05085.9A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all ver CVE-2025-05096.8A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassin CVE-2025-05106.5Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-CVE-2025-05116.1The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and CVE-2025-05125.4The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_busine CVE-2025-05135.4In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the CVE-2025-05147.8Improper Input Validation vulnerability in The Document Foundation LibreOffice allows Windows Executable hyperlink targets to be executed u CVE-2025-05154.3The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of da