CVE-2025-55070

Lack of MFA enforcement in WebSocket connections PUBLISHED

Description (CNA)

Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected <11 through <11; unaffected 11.0.0

CWE

CWE-306

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.