CVE-2025-62690 | THREATINT

Description

Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab.

PUBLISHED Reserved 2025-11-17 | Published 2025-12-17 | Updated 2025-12-17 | Assigner Mattermost

LOW: 3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Problem types

CWE‑601: URL Redirection to Untrusted Site (“Open Redirect”)

Product status

Default status

unaffected

10.11.0 (semver)

affected

11.1.0

unaffected

10.11.5

unaffected

Credits

Mario Puente finder

References

mattermost.com/security-updates

cve.org (CVE-2025-62690)

nvd.nist.gov (CVE-2025-62690)

Download JSON