CVE-2025-13870
Unauthorized access and subscription vulnerability in Boards
Reported by mattermost · Published December 2, 2025
github.com/mattermost/mattermost is fixed in 10.11.5 and 10.5.13 (Go Modules)
Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does not have access to
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/mattermost/mattermost | Go Modules | 10.11.5, 10.5.13 |
| github.com/mattermost/mattermost/server/v8 | Go Modules | 8.0.0-20251212204551-54f2e9b4afd5, 8.0.0-20250905150616-ba86dfc5876b |
| mattermost_server | mattermost | 10.11.5, 10.5.13 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 10.11.0, 10.5.0, 11.1.0 |
| Mattermost | Mattermost | 10.11.0, 10.5.0, 11.1.0 |
Timeline
- Dec 2, 2025 CVE Published
- Dec 2, 2025 CVE Updated
- Dec 7, 2025 EPSS Score (29 in total, the first dated here)
- Mar 10, 2026 Security Advisory
- Jun 23, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-13870
vulnetix vdb fixes CVE-2025-13870Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-13870/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart