CVE-2025-62190

MediumCVSS 4.3/10Last modified Oct 13, 2026

Description

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.0.0, <= 11.0.4; >= 10.12.0, <= 10.12.2; >= 10.11.0, <= 10.11.6

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Dec 17, 2025
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-621925.3SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession CVE-2025-621939.8Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerre CVE-2025-621985.4An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to ver CVE-2025-621997.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-62207.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CVE-2025-622007.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622017.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622027.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-622037.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622048.0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-622057.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-622066.5Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclo