CVE-2025-62190
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-17

Last updated on: 2025-12-29

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-17
Last Modified
2025-12-29
Generated
2026-06-16
AI Q&A
2025-12-17
EPSS Evaluated
2026-06-15
NVD
CVE-2025-62190
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost_server From 10.11.0 (inc) to 10.11.7 (exc)
mattermost mattermost_server From 10.12.0 (inc) to 10.12.3 (exc)
mattermost mattermost_server From 11.0.0 (inc) to 11.0.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a failure to implement Cross-Site Request Forgery (CSRF) protection on the Calls widget page in certain versions of Mattermost and Mattermost Calls. This allows an authenticated attacker to initiate calls and inject messages into channels or direct messages by tricking a user into visiting a malicious webpage or clicking a crafted link.

Impact Analysis

An attacker who exploits this vulnerability can cause unauthorized actions such as initiating calls and injecting messages into channels or direct messages without the user's consent, potentially leading to disruption, misinformation, or unauthorized communication within the Mattermost environment.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart