CVE-2025-55074

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

Score

CVSS 3.1 3.5 Low

Status

Analyzed - responsibledisclosure@mattermost.com

Published

2025-11-18

Last modified

2026-10-19

Weaknesses

CWE-1426

Affected products

• Mattermost (Mattermost)
• Mattermost Server (Mattermost)

References

• https://mattermost.com/security-updates