PT-2025-42443 · Mattermost · Mattermost

Daw10 · Published 2025-10-16 · Updated 2025-11-07 · CVE-2025-41410

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.10.x through 10.10.2 Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.11.x through 10.11.2

Description The software does not properly validate email ownership during a Slack import process. This allows attackers to create verified user accounts with arbitrary email domains by providing malicious Slack import data. This bypasses email-based team access restrictions.

Recommendations Update Mattermost to a version later than 10.10.2. Update Mattermost to a version later than 10.5.10. Update Mattermost to a version later than 10.11.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-13340

CVE-2025-41410

GHSA-3Q4Q-WQM6-HVF3

GO-2025-4029

OPENSUSE-SU-2025:15710-1

Affected Products

Mattermost

References · 86

• https://bdu.fstec.ru/vul/2025-13340 · Security Note
• https://osv.dev/vulnerability/GO-2025-4029 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3q4q-wqm6-hvf3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41410 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41410 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/0d6e8fa2e4681a172a136db18001104a57f9c28e · Note
• https://github.com/mattermost/mattermost/commit/01b95392a450676407475596d1c041a047067329 · Note
• https://github.com/mattermost/mattermost/commit/ef896a4ea60cacbe03124106e1f42e5c25276427 · Note
• https://suse.com/security/cve/CVE-2025-58356 · Note
• https://suse.com/security/cve/CVE-2025-61141 · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note
• https://twitter.com/VulmonFeeds/status/1978833809501004230 · Twitter Post