PT-2025-7705 · Mattermost · Mattermost

Eahmed · Published 2025-02-24 · Updated 2025-03-13 · CVE-2025-1412

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost versions 9.11.x through 9.11.6 Mattermost versions 10.4.x through 10.4.1

Description The issue arises when a user is converted to a bot, and the system fails to invalidate all active sessions. This allows the converted user to potentially escalate their privileges, depending on the permissions granted to the bot.

Recommendations For Mattermost versions 9.11.x through 9.11.6, update to a version later than 9.11.6 to resolve the issue. For Mattermost versions 10.4.x through 10.4.1, update to a version later than 10.4.1 to resolve the issue. As a temporary workaround, consider restricting the conversion of users to bots and limiting the permissions granted to bots to minimize the risk of exploitation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2025-1412

GHSA-RHVR-6W8C-6V7W

GO-2025-3482

OPENSUSE-SU-2025:14889-1

Affected Products

Mattermost

References · 43

• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3482 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1412 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1412 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rhvr-6w8c-6v7w · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/faa7e4f2ea0cca2fd2aba271912b9fc3be788842 · Note
• https://suse.com/security/cve/CVE-2025-24976 · Note
• https://suse.com/security/cve/CVE-2025-27090 · Note
• https://suse.com/security/cve/CVE-2025-27100 · Note
• https://suse.com/security/cve/CVE-2025-22952 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1412 · Note
• https://suse.com/security/cve/CVE-2025-27414 · Note
• https://suse.com/security/cve/CVE-2025-27507 · Note