CVE-2025-14573 | Vulnetix

CVE-2025-14573 PUBLISHED CVSS 3.799999952316284 LOW

Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. Mattermost Advisory ID: MMSA-2025-00560

EPSS 0.16% · 5.2th percentile

Risk Scores

CVSS 3.1

3.799999952316284

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS Score

0.16%

5.2th percentile

Affected Products

Vendor	Product	Versions
Mattermost	Mattermost	11.1.3, 10.11.0, 11.3.0
mattermost	mattermost_server	10.11.0
github.com	mattermost/mattermost-server	11.1.0, 0, 11.2.0
github.com	mattermost/mattermost/server/v8	0

Timeline

Jan 16, 2026 CVE Published
Feb 17, 2026 EPSS Score
Feb 19, 2026 EPSS Score
Feb 21, 2026 EPSS Score
Feb 23, 2026 EPSS Score
Feb 25, 2026 EPSS Score
Feb 26, 2026 EPSS Score
Feb 28, 2026 EPSS Score
Mar 2, 2026 EPSS Score
Mar 4, 2026 EPSS Score
Mar 6, 2026 EPSS Score
Mar 8, 2026 EPSS Score

References

https://github.com/mattermost/mattermost/commit/6404ab29acc04901c5cb1cf5ad97fc3c0693e2cd fix
https://mattermost.com/security-updates/ advisory
MMSA-2025-00561 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-14573 advisory
https://github.com/mattermost/mattermost package

Open in Interactive Console →