CVE-2025-58073
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-10-21
Assigner: Mattermost, Inc.
Description
Description
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.5.0 (inc) to 10.5.11 (exc) |
| mattermost | mattermost_server | From 10.10.0 (inc) to 10.10.3 (exc) |
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.3 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in certain versions of Mattermost where the system fails to verify if a user has permission to join a team when using the original invite token. An attacker can manipulate the OAuth state to join any team on a Mattermost server regardless of restrictions.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can join any team on a Mattermost server without proper authorization, potentially gaining access to sensitive team communications and data that should be restricted.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70