The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in CVE-2025-12421, MMSA-2025-00526 and CVE-2025-12756.

  - Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12     fail to to verify that the token used during the code exchange originates from the same     authentication flow, which allows an authenticated user to perform account takeover via a     specially crafted email address used when switching authentication methods and sending a     request to the /users/login/sso/code-exchange endpoint. The vulnerability requires     ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and     RequireEmailVerification to be disabled (default: disabled). (CVE-2025-12421)   
  - Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12     fail to sanitize team email addresses to be visible only to Team Admins, which allows any     authenticated user to view team email addresses via the     GET /api/v4/channels/{channel_id}/common_teams endpoint (CVE-2025-12559)   
  - Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12     fail to validate user permissions when deleting comments in Boards, which allows an     authenticated user with the editor role to delete comments created by other users.
    (CVE-2025-12756)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Mattermost Server 10.5.x <= 10.5.12 / 10.11.x <= 10.11.4 / 10.12.x <= 10.12.1 / 11.0.x <= 11.0.2 Multiple Vulnerabilities (CVE-2025-12421, MMSA-2025-00526, CVE-2025-12756)

critical Nessus Plugin ID 278109

Version 1.2

Version 1.1

Version 1.2 Dec 12, 2025, 5:16 PM New Plugin Feed: 202512121716
Version 1.1 Dec 11, 2025, 12:59 PM New Plugin Feed: 202512111259