Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. Mattermost Advisory ID: MMSA-2025-00563
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-14350 Mattermost Team Enumeration via Unauthorized Channel Mention Validation Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14350
Post summary
The text announces CVE-2025-14350, detailing a Mattermost team enumeration flaw caused by an unauthorized channel mention validation bypass, but offers no PoC, exploit code, or remediation guidance.
CVE-2025-14350 Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows aut… https://www.cve.org/CVERecord?id=CVE-2025-14350
Post summary
CVE-2025-14350 exposes a validation flaw in specific Mattermost versions that allows improper team membership handling during channel mentions; no PoC, exploit, patch, or active exploitation is reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mattermost | mattermost_server | - | - | - |