id: GO-2025-4248
modules:
    - module: github.com/mattermost/mattermost
      versions:
        - introduced: 10.11.0-rc1+incompatible
        - fixed: 11.1.0+incompatible
      non_go_versions:
        - fixed: 10.11.5-0.20251016131338-dad6bd7a1509
      vulnerable_at: 11.1.0-rc4+incompatible
    - module: github.com/mattermost/mattermost-server
      vulnerable_at: 11.3.0+incompatible
    - module: github.com/mattermost/mattermost-server/v5
      vulnerable_at: 5.39.3
    - module: github.com/mattermost/mattermost-server/v6
      vulnerable_at: 6.7.2
    - module: github.com/mattermost/mattermost/server/v8
      versions:
        - introduced: 8.0.0-20250721062209-4952acea88ce
        - fixed: 8.0.0-20251016131338-dad6bd7a1509
summary: |-
    Mattermost has missing redirect URL validation in
    github.com/mattermost/mattermost
cves:
    - CVE-2025-62690
ghsas:
    - GHSA-q66g-q98c-q454
references:
    - advisory: https://github.com/advisories/GHSA-q66g-q98c-q454
    - fix: https://github.com/mattermost/mattermost/commit/dad6bd7a1509054580a0898bbc0e026aac3b30cb
    - web: https://mattermost.com/security-updates
notes:
    - github.com/mattermost/mattermost does not have a canonical v10.11 fix, so everything from v10.11.0-rc1 to v11.1.0 is marked as vulnerable to be conservative.
    - fix: 'github.com/mattermost/mattermost/server/v8: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
    id: GHSA-q66g-q98c-q454
    created: 2026-01-13T11:02:32.549647845-05:00
review_status: UNREVIEWED