OAuth Authorization Flaw in Mattermost Plugin Affects Multiple Versions

CVE-2025-55073

What is CVE-2025-55073?

Mattermost versions 10.11.x (up to 10.11.3), 10.5.x (up to 10.5.11), and 10.12.x (up to 10.12.0) are susceptible to a vulnerability that compromises the integrity of post updates. The issue arises from a failure to properly validate the relationship between the posts being updated and the OAuth flow of the MSTeams plugin, allowing malicious actors to exploit crafted OAuth redirect URLs to edit arbitrary posts within the platform.

References