{"id":"CVE-2025-20033","aliases":["EUVD-2025-0004","GHSA-2549-xh72-qrpm","GO-2025-3379","SUSE-SU-2025:0297-1","openSUSE-SU-2025:14644-1"],"status":"published","title":"DoS via custom post type for sysconsole plugin readers","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00612,"percentile":0.49643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1287"],"published":"2025-01-09T06:55:02Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","fixed_in":["9.11.16","10.0.4","10.1.4","10.2.1","8.0.0-20250102081831-64c566a8280b"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","fixed_in":["10.0.4+incompatible","10.1.4+incompatible","10.2.1+incompatible"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.11.0"},{"fixed":"9.11.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0"},{"last_affected":"10.2.0"},{"fixed":"10.2.1"}]}],"versions":["10.2.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-20250102081831-64c566a8280b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"9.11.0"},{"fixed":"9.11.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"10.1.0"},{"fixed":"10.1.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"10.2.0"},{"fixed":"10.2.1"}]}],"versions":["10.2.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.0-20250102081831-64c566a8280b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost-server","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0+incompatible"},{"fixed":"10.0.4+incompatible"},{"introduced":"10.1.0+incompatible"},{"fixed":"10.1.4+incompatible"},{"introduced":"10.2.0+incompatible"},{"fixed":"10.2.1+incompatible"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost-server/v6","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/mattermost/mattermost/server/v8","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.0-20250102081831-64c566a8280b"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250109T194159-1.1"}]}],"bundled":4}],"products":[{"vendor":"mattermost","product":"mattermost"},{"vendor":"mattermost","product":"mattermost_server"}],"references":[{"url":"https://mattermost.com/security-updates","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20033","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2549-xh72-qrpm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/20xxx/CVE-2025-20033.json","tags":["advisory"]},{"url":"https://github.com/mattermost/mattermost","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24355","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L4N4W6VRBQ6LXRMKE4XQATP6QUUXHQOR/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-20033","title":"DoS via custom post type for sysconsole plugin readers","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","status":"published","published":"2025-01-09T06:55:02.063Z","modified":"2025-01-09T15:05:20.599Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:32:25.5658Z"}],"euvd":[{"id":"EUVD-2025-0004","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","status":"published","published":"2025-01-09T06:55:02Z","modified":"2025-01-09T15:05:20Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:23.094473Z"}],"ghsa":[{"id":"GHSA-2549-xh72-qrpm","title":"Mattermost Improper Validation of Specified Type of Input vulnerability","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","status":"published","published":"2025-01-09T09:31:42Z","modified":"2025-01-09T18:14:04Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2025-20033","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","status":"published","published":"2025-01-09T07:15:28.45Z","modified":"2026-06-17T08:40:33.57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:10:48.373347Z"}],"osv":[{"id":"CVE-2025-20033","title":"DoS via custom post type for sysconsole plugin readers","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","status":"published","published":"2025-01-09T06:55:02.063Z","modified":"2026-10-28T02:30:59.398863254Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"GHSA-2549-xh72-qrpm","title":"Mattermost Improper Validation of Specified Type of Input vulnerability","description":"Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.","status":"published","published":"2025-01-09T09:31:42Z","modified":"2026-09-10T03:50:56.279038415Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GO-2025-3379","title":"Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server","description":"Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/mattermost/mattermost-server from v9.11.0 before v9.11.16.","status":"published","published":"2025-01-09T19:41:59Z","modified":"2026-02-04T03:14:40.458317Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14644-1","title":"govulncheck-vulndb-0.0.20250109T194159-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250109T194159-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-14T00:00:00Z","modified":"2026-02-04T02:14:24.844391Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0297-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n  * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n  * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n  * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n  * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n  * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n  * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n  * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n  * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3372 CVE-2024-45339\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n  * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n  * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n  * GO-2025-3396 CVE-2024-52594\n  * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n  * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n  * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n  * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n  * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n  * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n  * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n  * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n  * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n  * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n  * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n  * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n  * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n","status":"published","published":"2025-01-30T14:03:37Z","modified":"2026-02-05T11:21:44.836869Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}