CVE-2025-30179

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Mar 21, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-30187.5A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of tCVE-2025-301826.7Uncontrolled search path for some Intel(R) Distribution for Python software installers before version 2025.2.0 within Ring 3: User ApplicatiCVE-2025-301837.5CyberData 011209 Intercom does not properly store or protect web server admin credentials.CVE-2025-301849.8CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.CVE-2025-301857.9Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. SCVE-2025-301865.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exCVE-2025-301873.7In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might bCVE-2025-301887.5Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is requirCVE-2025-301897.4When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be usCVE-2025-30197.2KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or opeCVE-2025-301905.4Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the cCVE-2025-301915.4Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sens