{"id":"CVE-2025-9078","aliases":["GHSA-9p92-x77w-9fw2","GO-2025-3959"],"url":"https://o3.security/vulnerability/CVE-2025-9078","summary":"Weak cache keys lead to post IDOR and link preview poisoning","details":"Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to properly validate cache keys for link metadata which allows authenticated users to access unauthorized posts and poison link previews via hash collision attacks on FNV-1 hashing","published":"2025-09-15T10:10:06.886Z","modified":"2026-09-18T03:45:28.721244787Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":{"score":0.00151,"percentile":0.04634,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","fixedVersion":"10.8.4"},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","fixedVersion":"10.5.9"},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","fixedVersion":"9.11.18"},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","fixedVersion":"10.10.2"},{"ecosystem":"Go","name":"github.com/mattermost/mattermost-server","fixedVersion":"10.9.4"},{"ecosystem":"Go","name":"github.com/mattermost/mattermost/server/v8","fixedVersion":"8.0.0-20250718075842-cd87e5c87737"}],"fix":{"url":"https://github.com/mattermost/mattermost/commit/356880c8430b77a4a390c89d5a33f6928188d137","label":"mattermost/mattermost@356880c"},"references":[{"type":"WEB","url":"https://mattermost.com/security-updates"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9078.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9078"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/356880c8430b77a4a390c89d5a33f6928188d137"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/944ad5cdd9876ef61c78c8275906262a4118755a"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/a8a4badc130be101e5bc4b7916bbcd2f966c4b79"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/cd87e5c877373f109742aa90a3fa136c14774325"},{"type":"PACKAGE","url":"https://github.com/mattermost/mattermost"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-18T03:45:28.721244787Z"}}