CVE-2025-9078: Mattermost Server Auth Bypass Vulnerability

CVE-2025-9078 Overview

CVE-2025-9078 affects Mattermost Server versions across multiple release branches. The flaw stems from improper validation of cache keys used for link metadata. Authenticated users can trigger hash collisions in the FNV-1 hashing algorithm to access unauthorized posts and poison link previews.

The weakness is classified under [CWE-328] (Use of Weak Hash). Exploitation requires valid credentials on the target Mattermost instance but no user interaction from victims.

Critical Impact
Authenticated attackers can leverage FNV-1 hash collisions to view unauthorized post metadata and inject malicious link previews into channels they should not influence.

Affected Products

Mattermost Server 10.8.x versions up to and including 10.8.3
Mattermost Server 10.5.x versions up to and including 10.5.8, 10.9.x up to 10.9.3, and 10.10.x up to 10.10.1
Mattermost Server 9.11.x versions up to and including 9.11.17

Discovery Timeline

2025-09-15 - CVE-2025-9078 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9078

Vulnerability Analysis

Mattermost caches link metadata such as URL previews to reduce redundant fetches. The cache key derivation relies on the FNV-1 non-cryptographic hash function. FNV-1 offers no collision resistance, so two distinct inputs can resolve to the same key.

When an authenticated user submits crafted URLs or post identifiers, the server can return cached metadata belonging to another post. The same primitive lets an attacker seed the cache with attacker-controlled content that is later served to other users viewing legitimate links.

The issue affects confidentiality but does not directly modify stored posts. Impact is limited to authenticated contexts and to data reachable through the link metadata cache.

Root Cause

The root cause is the selection of a weak hashing algorithm for security-sensitive cache indexing. FNV-1 was designed for speed, not adversarial resistance. Because cache keys derived from FNV-1 are the sole identifier for stored metadata, colliding inputs share storage slots and access decisions collapse to whichever entry was cached first.

Attack Vector

An authenticated attacker computes an input that produces the same FNV-1 hash as a target post's URL or identifier. Submitting that input causes the server to return the victim's cached metadata to the attacker, or replaces the cached entry so subsequent lookups serve poisoned previews. No elevated privileges are required beyond a standard user session.

Refer to the Mattermost Security Updates advisory for vendor technical details.

Detection Methods for CVE-2025-9078

Indicators of Compromise

Link previews rendering content that does not match the destination URL when clicked or inspected
Repeated posts by the same authenticated account containing URLs with unusual or programmatically generated query strings
Anomalous spikes in link metadata cache misses followed by unexpected hits across unrelated posts

Detection Strategies

Correlate Mattermost application logs with proxy or egress logs to identify URLs whose fetched content diverges from rendered previews
Baseline normal link-posting behavior per user and alert on accounts submitting large volumes of URLs with high-entropy path or query components
Review audit logs for repeated access attempts to posts or channels the requesting user is not a member of

Monitoring Recommendations

Enable verbose logging on the Mattermost link metadata subsystem during incident review windows
Ship Mattermost server logs to a centralized analytics platform for retention and correlation with authentication events
Track post_id and URL fields in access logs to identify collision-driven cross-post reads

How to Mitigate CVE-2025-9078

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 10.8.3, 10.5.8, 9.11.17, 10.10.1, or 10.9.3 depending on the deployed branch
Audit recent link previews in sensitive channels for content that does not match the underlying URL
Rotate session tokens for accounts suspected of abusing the link metadata cache

Patch Information

Mattermost has released patched versions for each supported branch. Consult the Mattermost Security Updates page for the specific fixed version applicable to your deployment. The patch replaces the vulnerable cache key derivation to eliminate collision-based access.

Workarounds

Disable link previews at the server or team level until patches are applied by setting EnableLinkPreviews to false in config.json
Restrict account creation and review existing low-privileged accounts to reduce the pool of potential attackers
Segment sensitive channels with stricter membership controls so cached metadata exposure is contained

bash

# Configuration example: disable link previews as a temporary workaround
# Edit config.json on the Mattermost server
{
  "ServiceSettings": {
    "EnableLinkPreviews": false
  }
}
# Then restart the Mattermost service
sudo systemctl restart mattermost