Vulnerability · Published Dec 17, 2025 · Assigned by Mattermost

CVE-2025-62190CSRF Allows Call Initiation and Message Delivery

Medium 4.3

In plain English

A medium-severity cross-site request forgery in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.1%top 98.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/mattermost/mattermost-plugin-calls	1.10.0	GHSA-gmx5-frv9-9m9f
Go	github.com/mattermost/mattermost-plugin-calls	1.10.0	GO-2025-4254

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.0.0 – through 11.0.410.12.0 – through 10.12.210.11.0 – through 10.11.6

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://mattermost.com/security-updates