PT-2025-51854 · Mattermost · Mattermost

Daw10 · Publicado 2025-12-17 · Atualizado 2026-01-06 · CVE-2025-13324

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.5 Mattermost versions 11.0.x through 11.0.4 Mattermost versions 10.12.x through 10.12.2

Description The software does not invalidate invite tokens after they are used. This allows a malicious actor who has intercepted an invite token to manipulate channel memberships. Specifically, they can add or remove users from private channels by replaying the token. The attack involves the replay of invite tokens.

Recommendations Update Mattermost to a version later than 10.11.5. Update Mattermost to a version later than 11.0.4. Update Mattermost to a version later than 10.12.2.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-13324

GHSA-X3R8-2HMH-89F5

GO-2025-4256

SUSE-SU-2026:0037-1

Produtos afetados

Mattermost

Referências · 88

• https://github.com/mattermost/mattermost/commit/9f54e5cdc3aef412945ff0e6a58338f7b549bdda · Nota
• https://github.com/mattermost/mattermost/commit/364c2203de00fe0d8424b6b46d6f0eeb02a2539a · Nota
• https://github.com/mattermost/mattermost/commit/7ccb62db7958abd6a4b21a06c5a4f5367a8f8b1f · Nota
• https://suse.com/security/cve/CVE-2025-8110 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13324 · Nota de Segurança
• https://suse.com/security/cve/CVE-2025-54410 · Nota
• https://suse.com/security/cve/CVE-2025-65754 · Nota
• https://suse.com/security/cve/CVE-2025-66565 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-68940 · Nota
• https://suse.com/security/cve/CVE-2025-67717 · Nota
• https://suse.com/security/cve/CVE-2025-68113 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20260037-1 · Nota
• https://suse.com/security/cve/CVE-2025-64715 · Nota
• https://suse.com/security/cve/CVE-2025-66490 · Nota