PT-2025-42446 · Mattermost · Mattermost

Doyensec · Published 2025-10-16 · Updated 2025-11-07 · CVE-2025-58075

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.10.x through 10.10.2 Mattermost versions 10.11.x through 10.11.1

Description A flaw exists in Mattermost where the system does not properly verify a user’s permission to join a team using an invite token. This allows an attacker to join any team on a Mattermost server, bypassing restrictions through manipulation of the RelayState parameter. The issue involves improper validation of user permissions when joining a team via an invite token.

Recommendations Update Mattermost to a version later than 10.5.10 Update Mattermost to a version later than 10.10.2 Update Mattermost to a version later than 10.11.1

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-13332

CVE-2025-58075

GHSA-R6QJ-894F-5HR2

GO-2025-4035

OPENSUSE-SU-2025:15710-1

Affected Products

Mattermost

References · 91

• https://osv.dev/vulnerability/GHSA-r6qj-894f-5hr2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13332 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58075 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58075 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4035 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/2d5cdc6e217eb244e7f2122cb89f85140b6d982a · Note
• https://github.com/mattermost/mattermost/commit/0e478b2d895e89143c7732c7b33e16d98ace663d · Note
• https://github.com/mattermost/mattermost/commit/7a2ac23e207429d7db8acc3770908c15c0b5c33e · Note
• https://suse.com/security/cve/CVE-2025-58356 · Note
• https://suse.com/security/cve/CVE-2025-61141 · Note
• https://suse.com/security/cve/CVE-2025-64102 · Note
• https://twitter.com/CCBalert/status/1979186334850785446 · Twitter Post