Mattermost Server CVE-2025-62690

Exploitation requires the victim to open an attacker-crafted link pointing at the Mattermost server's /error page in a new tab; the /error endpoint fails to validate the redirect URL (CWE-601), so no special server configuration is needed and default deployments of Mattermost Server 10.11.x through 10.11.4 are affected. The exploitation is strictly limited by two factors captured in the CVSS vector: it requires user interaction (UI:R - the victim must click/open the malicious link), and it yields no direct server compromise (open redirect only, enabling phishing/redirection rather than code execution or data exfiltration from the server). Authentication is not required to craft or send the link (PR:N).

This is a low-to-moderate priority issue despite the 6.1 (Medium) CVSS score, and the signals are internally consistent. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw that nevertheless requires user interaction - the victim must open a crafted link. EPSS strongly corroborates low real-world risk at 0.15% (4th percentile), indicating exploitation is statistically improbable in the near term. There is no CISA KEV listing and no public proof-of-concept identified, so there is no evidence of active exploitation or weaponization. The CWE-601 open-redirect weakness has inherently limited direct technical impact: it does not grant code execution or data access on the Mattermost server itself but rather abuses the trusted domain to facilitate phishing or redirection to attacker-controlled sites (reflected in C:L/I:L/A:N). The scope-change flag (S:C) accounts for the fact that the impact lands on the victim's trust relationship and external destination rather than the server. Net assessment: a legitimate hardening/phishing-enablement finding worth patching on a normal cadence, not an emergency. No key signals conflict here.

An attacker crafts a link to a victim's trusted Mattermost server that abuses the unvalidated redirect parameter on the /error page, then delivers it via a channel message, email, or chat. When the victim opens the link in a new tab, the trusted Mattermost domain transparently forwards them to an attacker-controlled phishing page that can harvest credentials or deliver malware. No public exploit code has been identified, but the technique is trivial to reproduce given the low attack complexity.