CVE-2025-12756

🗓️ 11 Dec 2025 20:02:52Reported by redhat.comType

CVE-2025-12756: Mattermost fails permission check for board comment deletion, enabling editors to delete others' comments.

Reporter	Title	Published	Views	Family All 17
CNNVD	Mattermost 安全漏洞	1 Dec 202500:00	–	cnnvd
CVE	CVE-2025-12756	1 Dec 202519:51	–	cve
Cvelist	CVE-2025-12756 Insecure Direct Object Reference in Mattermost Boards Plugin Enables Unauthorised Comment Deletion	1 Dec 202519:51	–	cvelist
EUVD	EUVD-2025-200087	1 Dec 202521:30	–	euvd
Github Security Blog	Mattermost fails to validate user permissions when deleting comments in Boards	1 Dec 202521:30	–	github
Tenable Nessus	Mattermost Server 10.5.x <= 10.5.12 / 10.11.x <= 10.11.4 / 10.12.x <= 10.12.1 / 11.0.x <= 11.0.2 Multiple Vulnerabilities (CVE-2025-12421, MMSA-2025-00526, CVE-2025-12756)	10 Dec 202500:00	–	nessus
NVD	CVE-2025-12756	1 Dec 202520:15	–	nvd
OSV	GHSA-P6GJ-JC38-X2M7 Mattermost fails to validate user permissions when deleting comments in Boards	1 Dec 202521:30	–	osv
OSV	GO-2025-4172 Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost	2 Dec 202519:46	–	osv
OSV	SUSE-SU-2025:4395-1 Security update for govulncheck-vulndb	15 Dec 202511:15	–	osv

Source	Link
cve	www.cve.org/CVERecord

11 Dec 2025 20:02Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.14.3

EPSS0.00035

SSVC