CVE-2025-11794: 
vulnerability analysis and mitigation

CVE-2025-11794 is an information exposure vulnerability in Mattermost Server that allows system administrators to access password hashes and MFA secrets via an unsanitized API endpoint. It affects Mattermost versions 10.11.0–10.11.3, 10.5.0–10.5.11, and 10.12.0. The vulnerability was published on November 14, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Mattermost Security).

The root cause is improper sanitization of user data returned by the POST /api/v4/users/{user_id}/email/verify/member endpoint, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When a system administrator calls this endpoint, the API response fails to strip sensitive fields — specifically bcrypt password hashes and TOTP-based MFA secrets — before returning user data. Exploitation requires network access and a high-privilege (system administrator) account, meaning the attack vector is network-based but the precondition of elevated privileges limits the attack surface (GitHub Advisory, Mattermost Security).

A malicious or compromised system administrator can retrieve plaintext-equivalent credential material — bcrypt password hashes and MFA (TOTP) secrets — for any user on the Mattermost instance. With password hashes, an attacker can conduct offline cracking attempts to recover plaintext passwords, potentially enabling account takeover across the platform and any services where users reuse credentials. MFA secret exposure allows an attacker to generate valid one-time codes, effectively bypassing multi-factor authentication protections. There is no integrity or availability impact; the risk is confined to confidentiality (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.044% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for system administrator privileges, significantly reducing the likelihood of opportunistic abuse (GitHub Advisory).

1. Obtain system administrator credentials: The attacker must already possess or compromise a Mattermost system administrator account, either through credential theft, phishing, or insider access.
2. Identify target user IDs: Use the Mattermost admin API (e.g., GET /api/v4/users) to enumerate user accounts and collect their user_id values.
3. Call the vulnerable endpoint: Send an authenticated POST /api/v4/users/{user_id}/email/verify/member request using the administrator's session token for each target user.
4. Extract sensitive fields: Parse the API response to retrieve the unsanitized password (bcrypt hash) and MFA secret fields that are incorrectly included in the response body.
5. Crack hashes or clone MFA: Use offline tools (e.g., Hashcat) to crack bcrypt hashes, or use the extracted TOTP secret to generate valid MFA codes, enabling full account takeover of targeted users (GitHub Advisory).

• Network/Logs: Unusual or repeated POST /api/v4/users/{user_id}/email/verify/member API calls in Mattermost access logs, especially in bulk or targeting multiple user IDs in rapid succession.
• Logs: Mattermost audit logs showing a system administrator account making email verification API calls outside of normal administrative workflows or at unusual hours.
• Behavioral: A system administrator account accessing the email verification endpoint for users who have not requested email verification, which is anomalous under normal operations.

Mattermost has released patched versions that sanitize the API response to remove sensitive fields: upgrade to 10.11.4, 10.5.12, or 10.12.1 (or later) to remediate the vulnerability (GitHub Advisory, Mattermost Security). No configuration-based workaround is available; upgrading is the only fix. As a precautionary measure, organizations should audit system administrator accounts, rotate user credentials and MFA secrets if unauthorized access is suspected, and enforce the principle of least privilege for administrative roles.

The vulnerability received standard community tracking coverage via vulnerability databases (VulnDB, CIRCL, Tenable) and social media posts on Mastodon/Infosec.exchange shortly after disclosure. No significant vendor statements beyond the Mattermost security advisory, nor notable independent researcher commentary, have been identified (Feedly).