CVE-2025-11794
Password hash and MFA secret returned in user email verification endpoint
Résumé
Password hash and MFA secret returned in user email verification endpoint
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com