Overview
CVE-2025-12559 is a Medium severity vulnerability affecting multiple versions of Mattermost. This vulnerability allows any authenticated user to view team email addresses that should be restricted to Team Administrators. The issue stems from a failure to properly sanitize team email addresses when accessed via the GET /api/v4/channels/{channel_id}/common_teams endpoint.
This security flaw affects Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, and 10.5.x <= 10.5.12.
Technical Details
The vulnerability lies in the insufficient access control when handling requests to the /api/v4/channels/{channel_id}/common_teams endpoint. Instead of properly verifying if the requesting user is a Team Admin, the API incorrectly exposes the team’s email addresses to any authenticated user who can access the specified channel. This means that if an attacker has valid credentials to log into a Mattermost instance within the affected versions, they can potentially retrieve sensitive email information.
CVSS Analysis
The vulnerability has a CVSS v3 score of 4.3 (Medium).
- CVSS Vector: (The vector string is not provided, but would typically be included here. A potential example: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N )
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low (Authenticated User)
- User Interaction: None
- Scope: Unchanged
- Confidentiality: Low
- Integrity: None
- Availability: None
This score reflects the relative ease of exploitation and the limited impact on the overall system (disclosure of potentially sensitive, but not critical, information).
Possible Impact
The disclosure of team email addresses can have several potential impacts:
- Phishing Attacks: Attackers can use the disclosed email addresses to launch targeted phishing campaigns against team members.
- Spam: The email addresses could be harvested and added to spam lists.
- Social Engineering: Knowing the email addresses of team members can aid in social engineering attacks.
Mitigation and Patch Steps
The recommended mitigation is to upgrade your Mattermost instance to a patched version that addresses this vulnerability. Specifically, upgrade to a version later than:
- 11.0.2 (for the 11.0.x series)
- 10.12.1 (for the 10.12.x series)
- 10.11.4 (for the 10.11.x series)
- 10.5.12 (for the 10.5.x series)
Check the official Mattermost security updates page for the latest information and patched releases.
References
- Mattermost Security Updates
- NIST NVD – CVE-2025-12559 (Note: This link might not exist yet as it is for a future CVE. Replace with the actual NVD link once available)
