CVE-2025-25068

Summary

CVE-2025-25068 is a vulnerability affecting Mattermost versions 10.4.x up to 10.4.2, 10.3.x up to 10.3.3, 9.11.x up to 9.11.8, and 10.5.x up to 10.5.0. This issue involves the failure to enforce Multi-Factor Authentication (MFA) on plugin endpoints. Attackers who are already authenticated can exploit this vulnerability by making API requests to plugin-specific routes, effectively bypassing the MFA protections in place. Successful exploitation could lead to unauthorized access to sensitive information or system functions within the affected Mattermost instances. Organizations using the vulnerable versions are strongly advised to update to the latest patches as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.