Servers and applications
CVE-2025-0503
Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.
- Severity
- Medium 5.3
- Published
- 14 Feb 2025
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 9.11.7
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MattermostServers and applications · cpe:a:mattermost:mattermost_server |
|