Medium
IDOR in CreatePost API allows for timeboxed message disclosure
Type: advisorySources: OSV
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-6226
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 10:16 UTC · Revision 1
Source evidence
IDOR in CreatePost API allows for timeboxed message disclosure
core-osv · Original sourcePublished 18 Jul 2025, 08:48 UTC
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
osv:CVE-2025-6226
Complete source record
{
"id": "336c4eee291f0d2159a149176266965591ac9d1627ca84115fa4563ea16356b6",
"url": "https://osv.dev/vulnerability/CVE-2025-6226",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "IDOR in CreatePost API allows for timeboxed message disclosure",
"summary": "Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.",
"evidence": "osv:CVE-2025-6226",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-6226",
"aliases": [
"CVE-2025-6226",
"GHSA-7h34-9chr-58qh",
"GO-2025-3819"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattermost/mattermost",
"type": "GIT",
"events": [
{
"introduced": "0bc2ddd42375a75ab14e63f038165150d4f07659"
},
{
"fixed": "8f8612c63783eff8188330973e4f533b323b4e32"
},
{
"introduced": "58bd34fd34cbd7d3da777d627b6cffdf8a532930"
},
{
"fixed": "341d662939e9482c7701d9fd35b066e5eabbc5a5"
},
{
"introduced": "f6b324a9d71843e8f48eba9e90dfbeabcbac1ae7"
},
{
"fixed": "dca75cc154561525603434721b5db1c48b5cdd6d"
},
{
"introduced": "bb105f3a2785636ad53b2d0bf4027900d41f6a67"
},
{
"fixed": "c2330fb5058d9a15d4d16eaf2c282ae61d45788c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.5.0"
},
{
"fixed": "10.5.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.7.0"
},
{
"fixed": "10.7.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.8.0"
},
{
"fixed": "10.8.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v10.7.4-rc1",
"v9.11.17-rc1",
"mattermost-redux@10.8.0",
"@mattermost/types@10.8.0",
"@mattermost/client@10.8.0",
"v9.11.16-rc1",
"v9.11.16",
"v10.5.6-rc1",
"v10.5.6",
"v10.7.3-rc1",
"v10.7.3",
"v10.8.1",
"v10.7.2",
"v10.7.2-rc1",
"v9.11.15",
"v10.5.5",
"v10.5.5-rc1",
"v9.11.14",
"v10.8.0-rc3",
"v10.8.0",
"v10.5.4-rc2",
"v10.5.4",
"v9.11.13",
"v10.5.4-rc1",
"v9.11.13-rc1",
"v10.7.1",
"v10.5.3",
"v9.11.12",
"v10.5.3-rc1",
"v9.11.12-rc1",
"v10.7.0-rc2",
"v10.7.0",
"mattermost-redux@10.7.0",
"@mattermost/types@10.7.0",
"@mattermost/client@10.7.0",
"v9.11.11-rc1",
"v9.11.11",
"v9.11.10",
"v10.5.2",
"v9.11.10-rc1",
"v9.11.9",
"v10.5.1",
"v10.5.1-rc2",
"v10.5.1-rc1",
"v9.11.9-rc2",
"v9.11.9-rc1",
"v10.5.0-rc6",
"v10.5.0",
"@mattermost/types@10.5.0",
"@mattermost/client@10.5.0",
"v9.11.8",
"v9.11.7-rc3",
"v9.11.7",
"v9.11.7-rc2",
"v9.11.7-rc1",
"v9.11.6",
"v9.11.6-rc2",
"v9.11.6-rc1",
"v9.11.5",
"v9.11.5-rc1",
"v9.11.4",
"v9.11.4-rc1",
"v9.11.3",
"v9.11.3-rc2",
"v9.11.3-rc1",
"v9.11.2",
"v9.11.2-rc2",
"v9.11.2-rc1",
"v9.11.1-rc1",
"v9.11.1",
"v9.11.0-rc3",
"v9.11.0",
"@mattermost/types@9.11.0",
"@mattermost/client@9.11.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6226.json"
}
}
],
"modified": "2026-10-28T02:30:43.755473400Z",
"provider": "osv",
"references": [
"https://mattermost.com/security-updates",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6226.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-6226"
],
"provider_metadata": {
"cwe_ids": [
"CWE-306"
],
"cna_assigner": "Mattermost",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "10.5.0"
},
{
"last_affected": "10.5.6"
},
{
"introduced": "10.8.0"
},
{
"last_affected": "10.8.1"
},
{
"introduced": "10.7.0"
},
{
"last_affected": "10.7.3"
},
{
"introduced": "9.11.0"
},
{
"last_affected": "9.11.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/6xxx/CVE-2025-6226.json"
}
},
"related_cves": [
{
"value": "CVE-2025-6226",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 511597,
"published_at": "2025-07-18T08:48:02.717+00:00"
}