{"id":"GHSA-gmx5-frv9-9m9f","summary":"Mattermost has CSRF vulnerability via Calls Widget page","details":"Mattermost versions 11.0.x \u003c 11.0.4, 10.12.x \u003c= 10.12.2, 10.11.x \u003c 10.11.6 and Mattermost Calls versions \u003c 1.10.0 fail to implement CSRF protection on the Calls widget page which allows an authenticated attacker to initiate calls and inject messages into channels or direct messages via a malicious webpage or crafted link.","aliases":["CVE-2025-62190","GO-2025-4254"],"modified":"2025-12-30T02:26:11.020001Z","published":"2025-12-17T15:34:53Z","database_specific":{"cwe_ids":["CWE-352"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-12-20T17:10:28Z","nvd_published_at":"2025-12-17T13:15:58Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62190"},{"type":"WEB","url":"https://github.com/mattermost/mattermost-plugin-calls/commit/429cfaf2a301a369414d1ca18a3364e85901c8d1"},{"type":"PACKAGE","url":"https://github.com/mattermost/mattermost-plugin-calls"},{"type":"WEB","url":"https://github.com/mattermost/mattermost-plugin-calls/releases/tag/v1.10.0"},{"type":"WEB","url":"https://mattermost.com/security-updates"}],"affected":[{"package":{"name":"github.com/mattermost/mattermost-plugin-calls","ecosystem":"Go","purl":"pkg:golang/github.com/mattermost/mattermost-plugin-calls"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-gmx5-frv9-9m9f/GHSA-gmx5-frv9-9m9f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}