CVE-2025-27538
CVSS 3.1 Score 2.2 of 10 (low)
Details
Published Apr 16, 2025
CWE ID 306
Summary
CVE-2025-27538 is a vulnerability affecting Mattermost versions 10.5.x up to 10.5.1 and 9.11.x up to 9.11.9. This issue allows users with edit_other_users permission to bypass Multi-Factor Authentication (MFA) checks when attempting to activate or deactivate MFA settings for other users through the PUT /api/v4/users/user-id/mfa endpoint. Even if the targeted user has not set up MFA, an attacker can manipulate the requesting user's identity to perform these actions, potentially compromising the security of other users' accounts.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Mattermost Server
Affected Vendors
- Mattermost