VDB
CVE-2025-12756
CVE-2025-12756
PUBLISHED
CVSS 4.3 MEDIUM
Reported by Mattermost · Published December 1, 2025
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate user permissions when deleting comments in Boards, which allows an authenticated user with the editor role to delete comments created by other users.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 11.0.0, 10.12.0, 10.11.0 |
| Mattermost | Mattermost | 11.0.0, 10.12.0, 10.11.0 |
Timeline
- Nov 5, 2025 CVE ID Reserved
- Dec 1, 2025 CVE Published
- Dec 1, 2025 CVE Updated
- Dec 2, 2025 EPSS Score
- Dec 7, 2025 EPSS Score
- Dec 12, 2025 EPSS Score
- Dec 17, 2025 EPSS Score
- Dec 21, 2025 EPSS Score
- Dec 26, 2025 EPSS Score
- Dec 31, 2025 EPSS Score
- Jan 5, 2026 EPSS Score
- Jan 10, 2026 EPSS Score