CVE-2025-12689
📋 TL;DR
This vulnerability allows attackers to crash the Calls plugin in Mattermost by sending malformed WebSocket requests with improper UTF-8 formatting. Affected organizations are those running vulnerable Mattermost versions with the Calls plugin enabled.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the Calls plugin functionality, disrupting voice/video communication capabilities for all users.
Likely Case
Temporary disruption of Calls plugin services requiring plugin restart or server reboot to restore functionality.
If Mitigated
No impact if the vulnerability is patched or if the Calls plugin is disabled.
🎯 Exploit Status
Exploitation requires sending malformed WebSocket requests, which is technically simple but requires understanding of the protocol and access to the WebSocket endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.5, 10.12.3, 10.11.7 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Upgrade to Mattermost 11.0.5, 10.12.3, or 10.11.7 or later. 3. Restart the Mattermost service. 4. Verify the Calls plugin functions correctly.
🔧 Temporary Workarounds
Disable Calls Plugin
allTemporarily disable the Calls plugin to prevent exploitation while planning upgrade.
mmctl plugin disable com.mattermost.calls
Restrict WebSocket Access
allImplement network controls to restrict WebSocket connections to trusted sources only.
🧯 If You Can't Patch
- Disable the Calls plugin immediately to eliminate the attack surface
- Implement strict network segmentation and firewall rules to limit WebSocket access to authorized users only
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mmctl versionCheck Version:
mmctl versionVerify Fix Applied:
Verify version is 11.0.5+, 10.12.3+, or 10.11.7+ and test Calls plugin functionality📡 Detection & Monitoring
Log Indicators:
- WebSocket connection errors
- Calls plugin crash logs
- Unusual malformed request patterns in access logs
Network Indicators:
- Abnormal WebSocket traffic patterns
- Multiple malformed WebSocket requests to Calls endpoints
SIEM Query:
source="mattermost" AND ("WebSocket error" OR "Calls plugin" AND (crash OR error))