CVE-2025-0503 — Leaked User IDs and Metadata of Deleted DMs

CVE-2025-0503

Leaked User IDs and Metadata of Deleted DMs PUBLISHED

Description (CNA)

Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.11.0 through 9.11.6; unaffected 10.4.0; unaffected 9.11.7

CWE

CWE-754

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.