Mattermost server versions prior to 11.1.0 and 8.0.0-20250912063506-7d8b7b5e4a60 do not enforce multi-factor authentication (MFA) on WebSocket connections. This vulnerability allows unauthenticated users to access sensitive information through WebSocket events. The issue has been assigned CVE-2025-55070 and has a medium severity rating with a CVSS score of 6.5. A patch is available in versions 11.1.0 and 8.0.0-20250912063506-7d8b7b5e4a60 that addresses this flaw.