CVE-2025-49810

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-498127.4In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middleCVE-2025-498137.2An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC veCVE-2025-498230.0(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell instCVE-2025-498241.7conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. PCVE-2025-498259.8Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and includinCVE-2025-498267.5Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning buCVE-2025-498279.8Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.22.0 and Secrets ManageCVE-2025-498288.8Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets ManageCVE-2025-498296.5Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows aCVE-2025-49838.7A stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x allCVE-2025-498306.5Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can useCVE-2025-498319.8An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network dev
CVE-2025-49810: Medium severity, CVSS 4.3 | Vulnix