Mattermost Server
CVE-2025-12689
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Mattermost server
-
DeliveryOpen WebSocket to Calls plug-in
-
ExploitSend request with malformed non-UTF-8 field
-
ExecutionTrigger unhandled encoding error
-
ImpactCrash Calls plug-in (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Specified type validation
|
| Exploitation Conditions | Exploitation requires the target Mattermost server to be running the Calls plug-in (the crashed component) and requires the attacker to hold a valid low-privilege authenticated account (PR:L) with the ability to open a WebSocket connection to the server. The specific trigger is a WebSocket request field containing improperly formatted (non-UTF-8) data. Limiting factors: servers without the Calls plug-in enabled are not affected; exploitation needs authentication rather than anonymous access; impact is confined to availability of the calling feature (no data exposure or code execution). Affected builds are limited to Mattermost Server 11.0.x ≤ 11.0.4, 10.12.x ≤ 10.12.2, and 10.11.x ≤ 10.11.6. |
| Impact | This is a medium-severity denial-of-service issue, not a top-tier priority. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) describes a network-reachable, low-complexity attack that requires low privileges (PR:L) and yields availability-only impact (A:H) with no confidentiality or integrity loss - consistent with crashing the Calls plug-in via a malformed WebSocket frame (CWE-1287, improper input validation). The exploitation signals are modest and mutually consistent: EPSS is 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. PR:L means the attacker must already be an authenticated Mattermost user, which meaningfully narrows the threat to insiders or anyone who can obtain a server account, rather than fully anonymous internet attackers. No signals conflict here - low EPSS, no KEV, and availability-only impact all point to a real but non-urgent bug. The main caveat is scope: impact is limited to the Calls plug-in/real-time calling feature, so environments that do not run Calls are effectively unaffected; this is not independently confirmed beyond the single NVD-linked vendor advisory. |
| Exploit ScenarioDerived | An authenticated user on an affected Mattermost server (one running the Calls plug-in) opens a WebSocket connection and sends a request containing a field with malformed, non-UTF-8 byte sequences. The server fails to validate the encoding and the Calls plug-in crashes, disrupting voice/video calling for all users until it recovers. No public exploit code has been identified, but the malformed-input trigger is simple to reproduce for an authenticated attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in Mattermost Server affects versions 11.0.x through 11.0.4, 10.12.x through 10.12.2, and 10.11.x through 10.11.6 when the Calls plug-in is enabled: a malformed WebSocket request field that is not valid UTF-8 is not rejected, causing the Calls plug-in to crash. The attacker must be an authenticated, low-privilege user (CVSS vector PR:L) capable of opening a WebSocket connection to the server, and the impact is limited to availability of the calling functionality with no data exposure or code execution. Severity is medium (CVSS 6.5, C:N/I:N/A:H); EPSS is 0.29% (20th percentile) and no public exploit identified at time of analysis - this is a medium-severity availability issue, not a top-tier priority.
RemediationAI
Upgrade Mattermost Server to a release newer than the affected ceilings in each supported line - that is, above 11.0.4, above 10.12.2, and above 10.11.6 - as documented in the Mattermost security updates advisory at https://mattermost.com/security-updates; the advisory is the authoritative source for the exact fixed build numbers, so confirm the specific target version there before upgrading. Where immediate upgrading is not possible, the most effective compensating control is to disable or remove the Mattermost Calls plug-in (System Console → Plugin Management), which takes the vulnerable code path out of service at the cost of losing voice/video calling features; since exploitation requires a valid low-privilege authenticated account, tightening who can register or be granted accounts on the server, and restricting WebSocket access to trusted networks or through an authenticating reverse proxy, raises the bar for a would-be attacker but does not fix the underlying validation gap. Note that simply monitoring or rate-limiting WebSocket connections is only a partial hedge - a single malformed frame is sufficient to crash the plug-in, and the plug-in will typically be restarted automatically, so repeated attempts can produce a sustained, repeatable denial of the calling service until the server is patched. No vendor-released patch version was independently confirmed from the provided data beyond the affected range ceilings, and no public exploit code is known at time of analysis.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-1287 (Improper Validation of Specified Type of Input): Mattermost Server consumes data from a WebSocket connection without verifying that a request field is well-formed UTF-8 before handing it to the Calls plug-in. WebSocket text frames are required by the protocol to carry valid UTF-8 payloads, so a service is expected to validate (or fail the connection on) non-conforming payloads rather than pass them downstream. The affected component is the Mattermost Calls plug-in, the WebRTC-based voice/video calling extension whose signaling and event traffic flows over the server's WebSocket layer; a failed decode or type assumption inside the plug-in leads to a panic/crash of the plug-in process rather than a controlled rejection. Because the defect is an input-validation gap reachable over the network by any client that can authenticate and open a WebSocket, but is confined to the calling feature, the CPE-identified impact is availability-only (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Servers that do not have the Calls plug-in enabled are not exposed to this code path.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable WebSocket with a trivial malformed-input trigger (AV:N/AC:L), requires an authenticated account (PR:L), no user interaction, availability-only crash of the Calls plug-in (C:N/I:N/A:H).
Primary rating from Vendor (mattermost).
CVSS VectorVendor: mattermost
DescriptionCVE.org
Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 fail to check WebSocket request field for proper UTF-8 format, which allows attacker to crash Calls plug-in via sending malformed request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
GitHub PoC
Exploit-DB