PT-2025-51854 · Mattermost · Mattermost

Daw10 · Published 2025-12-17 · Updated 2026-01-06 · CVE-2025-13324

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.5 Mattermost versions 11.0.x through 11.0.4 Mattermost versions 10.12.x through 10.12.2

Description The software does not invalidate invite tokens after they are used. This allows a malicious actor who has intercepted an invite token to manipulate channel memberships. Specifically, they can add or remove users from private channels by replaying the token. The attack involves the replay of invite tokens.

Recommendations Update Mattermost to a version later than 10.11.5. Update Mattermost to a version later than 11.0.4. Update Mattermost to a version later than 10.12.2.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-13324

GHSA-X3R8-2HMH-89F5

GO-2025-4256

SUSE-SU-2026:0037-1

Affected Products

Mattermost

References · 88

• https://nvd.nist.gov/vuln/detail/CVE-2025-13324 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4256 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13324 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/9f54e5cdc3aef412945ff0e6a58338f7b549bdda · Note
• https://github.com/mattermost/mattermost/commit/364c2203de00fe0d8424b6b46d6f0eeb02a2539a · Note
• https://github.com/mattermost/mattermost/commit/7ccb62db7958abd6a4b21a06c5a4f5367a8f8b1f · Note
• https://suse.com/security/cve/CVE-2025-8110 · Note
• https://suse.com/security/cve/CVE-2025-54410 · Note
• https://suse.com/security/cve/CVE-2025-65754 · Note
• https://suse.com/security/cve/CVE-2025-66565 · Note
• https://suse.com/security/cve/CVE-2025-68940 · Note
• https://suse.com/security/cve/CVE-2025-67717 · Note
• https://suse.com/security/cve/CVE-2025-68113 · Note