GHSA-x3r8-2hmh-89f5 (CVE-2025-13324)

Details

Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

Affected Packages

github.com/mattermost/mattermost

Go

Fixed in:

10.11.5

github.com/mattermost/mattermost

Go

Fixed in:

10.12.2

github.com/mattermost/mattermost

Go

Fixed in:

11.0.4

github.com/mattermost/mattermost-server

Go

Fixed in:

11.0.4

github.com/mattermost/mattermost/server/v8

Go

Fixed in:

8.0.0-20251031095924-e7e23b94e006

References

ADVISORYhttps://github.com/advisories/GHSA-x3r8-2hmh-89f5 PACKAGEhttps://github.com/mattermost/mattermost WEBhttps://github.com/mattermost/mattermost/commit/364c2203de00fe0d8424b6b46d6f0eeb02a2539a WEBhttps://github.com/mattermost/mattermost/commit/7ccb62db7958abd6a4b21a06c5a4f5367a8f8b1f WEBhttps://github.com/mattermost/mattermost/commit/9f54e5cdc3aef412945ff0e6a58338f7b549bdda WEBhttps://mattermost.com/security-updates ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-13324

GHSA-x3r8-2hmh-89f5

Details

Affected Packages

References

Aliases

CVSS Analysis

Related

Ecosystems

Timeline