CVE-2025-13821 — Vulnetix

Try Vulnetix Request Demo

CVE-2025-13821 PUBLISHED CVSS 5.699999809265137 MEDIUM

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560

EPSS 0.04% · 11.3th percentile

Risk Scores

CVSS v3.1

5.699999809265137

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS Score

0.04%

11.3th percentile

Affected Products

Vendor	Product	Versions
github.com	mattermost/mattermost/server/v8	0, 0, 0
github.com	mattermost/mattermost-server	10.11.0, 10.11.0, 11.2.0
Mattermost	Mattermost	11.1.0, 10.11.0, 11.2.0
mattermost	mattermost_server	11.1.0, 11.2.0, 11.1.0

Timeline

Jan 16, 2026 CVE Published
Feb 16, 2026 EPSS Score
Feb 17, 2026 EPSS Score
Feb 19, 2026 EPSS Score
Feb 20, 2026 EPSS Score
Feb 21, 2026 EPSS Score
Feb 22, 2026 EPSS Score
Feb 24, 2026 EPSS Score
Feb 25, 2026 EPSS Score
Feb 26, 2026 EPSS Score
Feb 27, 2026 EPSS Score
Mar 1, 2026 EPSS Score

References

https://mattermost.com/security-updates/ advisory
MMSA-2025-00560 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-13821 advisory
https://github.com/mattermost/mattermost/commit/cd17b61de41bf0a49b524bb91ce0bbe859e5a100 url
https://github.com/mattermost/mattermost package

Open in Interactive Console →