User Data Sanitization Flaw in Mattermost

CVE-2025-11794

What is CVE-2025-11794?

Certain versions of Mattermost exhibit a data sanitization issue that allows system administrators to exploit the /api/v4/users/{user_id}/email/verify/member endpoint, potentially exposing sensitive user data such as password hashes and multi-factor authentication secrets. This vulnerability emphasizes the critical need for robust data handling practices to ensure user data remains secure.

References