VDB
GHSA-q66g-q98c-q454
GHSA-q66g-q98c-q454
PUBLISHED
CVSS 3.0999999046325684 LOW
Mattermost has missing redirect URL validation
Record from GitHub Advisory Database · Published December 17, 2025
github.com/mattermost/mattermost is fixed in 11.1.0, 10.11.5-0.20251016131338-dad6bd7a1509 and 10.11.5-0.20251016131338 (Go Modules)
Mattermost has missing redirect URL validation
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/mattermost/mattermost | Go Modules | 11.1.0, 10.11.5-0.20251016131338-dad6bd7a1509, 10.11.5-0.20251016131338 |
| github.com/mattermost/mattermost/server/v8 | Go Modules | 8.0.0-20251016131338-dad6bd7a1509, 8.0.0-20251016131338 |
Risk scores
CVSS 3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| github.com | mattermost/mattermost/server/v8 | |
| github.com | mattermost/mattermost | 11.0.0-alpha.1 |
Timeline
- Dec 17, 2025 CVE Published
- Apr 9, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-q66g-q98c-q454
vulnetix vdb fixes GHSA-q66g-q98c-q454Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-q66g-q98c-q454/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart