CVE-2025-30516 Unauthorized Notification Exposure in Mobile App Under Specific Conditions

Q: Is CVE-2025-30516 being exploited?

There is no known exploitation of CVE-2025-30516 in the wild and no public exploit code.

Q: How do I fix CVE-2025-30516?

No fix has been published for CVE-2025-30516 yet. Limit exposure of the affected software until one is available.

Low 2.0 Published 14 Apr 2025 Updated 14 Apr 2025

Attackers on shared devices can access sensitive notification content due to session termination failures during logout under poor connectivity conditions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-30516?

CVE-2025-30516 is a low-severity vulnerability in Mattermost, published on 14 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Mattermost Mobile Apps versions <=2.25.0 fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications

Weakness: CWE-613

Which versions are affected by CVE-2025-30516?

It affects 1 product.

Products include Mattermost Mattermost Mobile.

How do I fix CVE-2025-30516?

No fix has been published for CVE-2025-30516 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-30516 being exploited?

There is no known exploitation of CVE-2025-30516 in the wild and no public exploit code.

Sources

Also known as GHSA-w8hx-xwgf-2m86.