{"id":"CVE-2025-62190","title":"Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and i…","summary":"Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and i…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-352"],"vendor":"mattermost","product":"mattermost_server","affected":["mattermost_server >= 10.11.0, < 10.11.7","mattermost_server >= 10.12.0, < 10.12.3","mattermost_server >= 11.0.0, < 11.0.5"],"patched":["mattermost_server 11.0.5"],"published":"2025-12-17","updated":"2026-10-13","sourceUpdated":"2026-10-13T11:10:00.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62190","references":[{"url":"https://mattermost.com/security-updates","label":"responsibledisclosure@mattermost.com"}],"tags":["nvd"],"epss":0.0012,"epssPercentile":0.01656,"ingestedAt":"2026-10-13T11:23:51.116Z","slug":"CVE-2025-62190","body":"## Overview\n\nMattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link\n\n## Affected\n\n- `mattermost_server >= 10.11.0, < 10.11.7`\n- `mattermost_server >= 10.12.0, < 10.12.3`\n- `mattermost_server >= 11.0.0, < 11.0.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mattermost_server 11.0.5`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}