Platform
go
Component
github.com/mattermost/mattermost-server
Fixed in
10.5.2
9.11.10
10.5.2
9.11.10+incompatible
9.11.10+incompatible
CVE-2025-27538 describes a missing authentication check within the Mattermost Server, a popular open-source communication platform. This flaw allows an attacker to bypass authentication controls and access critical functionalities without proper authorization. The vulnerability impacts versions of Mattermost Server prior to 9.11.10+incompatible, and a fix is available in that version.
The core impact of CVE-2025-27538 lies in the ability to access Mattermost Server functionalities without authentication. An attacker could potentially read sensitive data, modify configurations, or even gain administrative access depending on the specific functionality affected by the missing authentication check. While the CVSS score is LOW, the potential for unauthorized access to sensitive communication data and system configuration warrants immediate attention. The blast radius could extend to all users within a Mattermost workspace if the vulnerability is exploited to compromise administrative accounts.
CVE-2025-27538 was published on April 22, 2025. As of this date, there are no publicly known active campaigns or Proof-of-Concept (POC) exploits. The vulnerability is not currently listed on KEV or EPSS, indicating a low probability of immediate exploitation. However, given the nature of the vulnerability (authentication bypass), it is likely to attract attention from security researchers and potentially be incorporated into automated scanning tools.
Exploit Status
EPSS
0.18% (39% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-27538 is to upgrade Mattermost Server to version 9.11.10+incompatible or later. Before upgrading, review Mattermost's release notes for any potential breaking changes that might impact existing integrations or customizations. If a direct upgrade is not immediately feasible, consider implementing stricter access controls and monitoring for suspicious activity. While a WAF or proxy cannot directly prevent this authentication bypass, it can help detect and block malicious requests attempting to exploit the vulnerability. After upgrading, confirm the fix by attempting to access the affected functionality without proper authentication credentials and verifying that access is denied.
Actualice Mattermost a una versión posterior a 10.6.0. Si no es posible actualizar inmediatamente, revise los permisos de usuario y restrinja el acceso a la función 'edit_other_users' solo a los administradores confiables. Monitoree la actividad de los usuarios con permisos elevados para detectar cualquier actividad sospechosa.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-27538 is a LOW severity vulnerability in Mattermost Server that allows attackers to bypass authentication controls and access critical functionalities without proper authorization, impacting versions prior to 9.11.10+incompatible.
You are affected if you are running Mattermost Server versions prior to 9.11.10+incompatible. Check your current version using /opt/mattermost/bin/mattermost version and upgrade immediately if necessary.
Upgrade Mattermost Server to version 9.11.10+incompatible or later. Review Mattermost's release notes for potential breaking changes before upgrading.
As of April 22, 2025, there are no publicly known active campaigns or Proof-of-Concept (POC) exploits for CVE-2025-27538.
Refer to the Mattermost security advisories page for the latest information and official announcements regarding CVE-2025-27538: [https://mattermost.com/security/](https://mattermost.com/security/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your go.mod file and we'll tell you instantly if you're affected.