Mattermost 在 github.com/mattermost/mattermost-server 中的关键功能缺少身份验证

The core impact of CVE-2025-27538 lies in the ability to access Mattermost Server functionalities without authentication. An attacker could potentially read sensitive data, modify configurations, or even gain administrative access depending on the specific functionality affected by the missing authentication check. While the CVSS score is LOW, the potential for unauthorized access to sensitive communication data and system configuration warrants immediate attention. The blast radius could extend to all users within a Mattermost workspace if the vulnerability is exploited to compromise administrative accounts.

1. 已保留2025-04-08
2. 发布日期2025-04-22
3. 修改日期2026-02-04
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-27538 is to upgrade Mattermost Server to version 9.11.10+incompatible or later. Before upgrading, review Mattermost's release notes for any potential breaking changes that might impact existing integrations or customizations. If a direct upgrade is not immediately feasible, consider implementing stricter access controls and monitoring for suspicious activity. While a WAF or proxy cannot directly prevent this authentication bypass, it can help detect and block malicious requests attempting to exploit the vulnerability. After upgrading, confirm the fix by attempting to access the affected functionality without proper authentication credentials and verifying that access is denied.