---
id: CVE-2025-62190
title: >-
  Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6
  and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on
  the Calls widget page which allows an authenticated attacker to initiate calls
  and i…
summary: >-
  Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6
  and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on
  the Calls widget page which allows an authenticated attacker to initiate calls
  and i…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.7'
  - 'mattermost_server >= 10.12.0, < 10.12.3'
  - 'mattermost_server >= 11.0.0, < 11.0.5'
patched:
  - mattermost_server 11.0.5
published: '2025-12-17'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62190'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.0012
epssPercentile: 0.01656
ingestedAt: '2026-10-13T11:23:51.116Z'
---

## Overview

Mattermost versions 11.0.x <= 11.0.4, 10.12.x <= 10.12.2, 10.11.x <= 10.11.6 and Mattermost Calls versions <=1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link

## Affected

- `mattermost_server >= 10.11.0, < 10.11.7`
- `mattermost_server >= 10.12.0, < 10.12.3`
- `mattermost_server >= 11.0.0, < 11.0.5`

## Remediation

Upgrade past the affected range:

- `mattermost_server 11.0.5`