CVE-2025-9076

—

CVSS 3.1

6.5 medium

EPSS

<1%p18

Published

Sep 15, 2025 (Sep 15, 2025)

Modified

Jun 17, 2026

Description

Mattermost versions 10.10.x <= 10.10.1 fail to properly sanitize user data during shared channel membership synchronization, which allows malicious or compromised remote clusters to access sensitive user information via unsanitized user objects. This vulnerability affects Mattermost Server instances with shared channels enabled.

Vendors: mattermost
Products: mattermost server
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.