Mattermost possui vulnerabilidade CSRF via página Calls Widget em github.com/mattermost/mattermost-plugin-calls

A successful CSRF attack exploits the trust a website has in a user's browser. In this case, an attacker could craft a malicious request that, when triggered by a logged-in Mattermost user, could perform actions such as initiating calls, modifying call settings, or potentially accessing sensitive information associated with the user's calls. The blast radius is limited to the actions that can be performed through the Calls Widget interface, but the impact can be significant if an attacker gains control over critical call functionalities. This vulnerability highlights the importance of proper CSRF protection for all user-facing components within Mattermost.

Organizations heavily reliant on the Mattermost Calls Widget for internal or external communication are at increased risk. Specifically, deployments with limited security controls or those lacking robust CSRF protection mechanisms are particularly vulnerable. Teams using older versions of the Calls Widget plugin without regular security updates are also at significant risk.

• go / server: Examine Mattermost plugin logs for unusual call initiation requests or modifications to call settings. Look for requests originating from unexpected sources or with suspicious parameters.

journalctl -u mattermost -f | grep "Calls Widget"

• generic web: Monitor Mattermost instance access logs for requests to the Calls Widget endpoints with unusual HTTP referer headers. A referer header not originating from the Mattermost domain could indicate a CSRF attempt.

curl -I <mattermost_calls_widget_url> | grep Referer

1. 2025-12-30Disclosure

   disclosure

1. Reservado2025-11-17
2. Publicada2025-12-30
3. Modificada2026-03-03
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2025-62190 is to upgrade the Mattermost Calls Widget plugin to version 1.10.0 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive endpoints within the Calls Widget. While not a complete solution, this can significantly reduce the attack surface. Additionally, review Mattermost's security best practices for CSRF protection. After upgrading, confirm the vulnerability is resolved by attempting to trigger a call action via a crafted URL – the request should be rejected if CSRF protection is properly implemented.