# CVE-2025-0503: Leaked User IDs and Metadata of Deleted DMs

> CVE-2025-0503: Leaked User IDs and Metadata of Deleted DMs. CVSS 3.1 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-0503
Last updated: 2026-06-17T08:26:36Z

- Published: 2025-02-14 17:52 UTC · Updated: 2026-06-17 08:26 UTC · Assigner: Mattermost
- CVSS: 3.1 (CVSS 3.1) · Severity: Low · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS: 0.25%, 17th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-754

## Description

Mattermost versions 9.11.x \<= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.

## Affected vendors and products

- Mattermost: Mattermost

## Tracked companies

- [Mattermost](https://rewindex.com/company/mattermost.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-0503)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-0503)
- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-0503 · Markdown: https://rewindex.com/cve/CVE-2025-0503.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-0503 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:24.661Z