← Database

CVE-2025-30179

MEDIUM CVSS: 4.3 Published: 2025-03-21 Modified: 2026-06-17

Description

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.

Affected Platforms

Mattermost Mattermost Server

Weakness Type

CWE-863, CWE-863

References