Mattermost Server CVE-2025-62190

Exploitation requires that a victim who is already authenticated to a vulnerable Mattermost instance (Server 11.0.x <=11.0.4, 10.12.x <=10.12.2, 10.11.x <=10.11.6, or Mattermost Calls <=1.10.0) visits an attacker-controlled webpage or clicks a crafted link while their session is active - the flaw is the absence of CSRF protection (anti-CSRF token/SameSite enforcement) specifically on the Calls widget page. Key limiting factors: the attacker cannot act without a logged-in victim performing the interaction (UI:R), impact is confined to initiating calls and injecting messages as that user (I:L, C:N/A:N), and instances not running the Calls feature/plugin or already patched are not exposed. There is no server-side code execution or privilege escalation.

This is a genuine but low-urgency issue, correctly rated as medium severity (CVSS 4.3). All signals align toward low real-world risk: the CVSS vector (AV:N/AC:L/PR:N/UI:R) shows a network-reachable, low-complexity CSRF that requires victim user interaction, with only limited integrity impact (I:L) and no confidentiality or availability impact. EPSS is very low at 0.12% (2nd percentile), it is NOT on the CISA KEV list, and no public POC was provided - three independent low-risk indicators that are mutually consistent, with no conflict between them. One point needs clarification: the CVSS vector encodes PR:N (no attacker privileges) while the description says 'authenticated attacker.' These are not actually in conflict - this is classic CSRF, where the attacker needs no credentials of their own but rides the session of an already-authenticated victim who is tricked into visiting a malicious page; PR:N is the correct encoding. The realistic impact is bounded to initiating calls and injecting messages into channels/DMs as the victim, not server compromise or data theft. Net: a legitimate fix-in-normal-patch-cycle issue, not a drop-everything priority.

An attacker crafts a malicious webpage or link and lures an authenticated Mattermost user (e.g., via a message, email, or external link) into opening it while logged into Mattermost. Because the Calls widget page lacks CSRF protection, the page silently forces the victim's browser to initiate calls or post messages into channels or direct messages on the victim's behalf. No public exploit code was identified at time of analysis, and success depends on the victim interacting with the attacker-controlled content.