CVE-2025-62190
📋 TL;DR
This CSRF vulnerability in Mattermost allows authenticated attackers to initiate calls and inject messages into channels or direct messages via malicious webpages or links. It affects Mattermost versions 11.0.4 and below, 10.12.2 and below, 10.11.6 and below, and Mattermost Calls versions 1.10.0 and below.
💻 Affected Systems
- Mattermost
- Mattermost Calls
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Attackers could spam channels with malicious content, initiate unwanted calls disrupting communication, or use message injection as part of social engineering attacks.
Likely Case
Unauthorized message injection into channels or DMs, potentially leading to phishing, misinformation, or harassment within the platform.
If Mitigated
Limited impact with proper CSRF protections and user awareness training about suspicious links.
🎯 Exploit Status
Exploitation requires the victim to be authenticated and visit a malicious page or click a crafted link.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Mattermost 11.0.5, 10.12.3, 10.11.7; Mattermost Calls 1.10.1
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Upgrade to patched versions: Mattermost 11.0.5+, 10.12.3+, or 10.11.7+ and Mattermost Calls 1.10.1+. 3. Restart the Mattermost service.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure CSRF protection is enabled in Mattermost configuration if not already.
Check config.json for "EnableCSRFProtection": true
Restrict Calls Widget Access
allTemporarily restrict access to the Calls widget page via network controls.
🧯 If You Can't Patch
- Implement web application firewall rules to detect and block CSRF attempts.
- Educate users about the risks of clicking unknown links and enable logging for suspicious activities.
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Confirm version is patched: Mattermost >=11.0.5, >=10.12.3, >=10.11.7 and Mattermost Calls >=1.10.1📡 Detection & Monitoring
Log Indicators:
- Unexpected call initiations from users
- Unusual message injection patterns in channel logs
Network Indicators:
- CSRF token validation failures in web logs
- Requests to Calls widget without proper referrer headers
SIEM Query:
source="mattermost" AND (event="call_initiated" OR event="message_posted") AND user_agent CONTAINS "malicious"