Medium WID-SEC-2025-0905 5 CVEs

Mattermost: Mehrere Schwachstellen

Published Apr 29, 2025 · Updated Jun 11, 2025 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 5

Medium 5.4

CVE-2025-3230

Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token valida…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

May 30, 2025
Medium 5.3

CVE-2025-3913

Team Privacy Settings Authorization Bypass in Mattermost Server

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team …

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

May 29, 2025
Medium 4.2

CVE-2025-2571

Google OAuth Authentication Bypass for Converted Bot Accounts

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAu…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

May 30, 2025
Low 3.1

CVE-2025-1792

Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via t…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

May 30, 2025
Low 3.1

CVE-2025-3611

Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have acc…

Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go

May 30, 2025

Revision history

2025-06-11 #2
CVE, Bewertung und Beschreibung nach Veröffentlichung von Mattermost ergänzt
2025-04-29 #1
Initiale Fassung

References

Mattermost Security Updates vom 2025-04-29
https://mattermost.com/security-updates/#server