CVE-2025-9081
IDOR in board file download allows any user to download any file by UUID
Summary
IDOR in board file download allows any user to download any file by UUID
Original description
The description as published by the source.
Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com