Mattermost Server CVE-2025-13324

Exploitation requires three concrete conditions, all drawn from the description: (1) the attacker must have already obtained a valid remote-cluster invite token; (2) the Mattermost server must be using the legacy remote-cluster secure connection protocol (version 1), OR the confirming party must not provide a refreshed token during invitation confirmation; and (3) the target must have the remote-cluster / shared-channels feature actually configured and in use. The impact is further limited to 'limited actions on shared channels' with no confidentiality or availability effect. Deployments that do not use remote clusters/shared channels, or that use the newer (v2) protocol with refreshed-token confirmation, are not exposed. These factors, combined with the token prerequisite, sharply narrow realistic exploitability despite the network attack vector.

This is a genuinely low-priority issue, and the available signals are consistent rather than conflicting. The vendor-assigned CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) yields a base score of 3.7 (Low), driven by high attack complexity and a limited integrity-only impact with no confidentiality or availability consequence. EPSS corroborates this at 0.20% (9th percentile), indicating very low predicted exploitation likelihood. The flaw is NOT in CISA KEV and no public exploit code was identified, so there is no public exploit identified at time of analysis. The CWE-863 (incorrect authorization) classification fits: the real-world precondition is that an attacker must already have obtained a valid remote-cluster invite token, which is not freely available and must be acquired out-of-band - this is why AC:H is justified despite the PR:N label. One nuance worth noting: the CVSS vector records PR:N (no privileges on the target), yet exploitation materially depends on possessing a secret invite token; this prerequisite is folded into AC:H rather than PR, so the PR:N label can overstate how 'unauthenticated' the attack truly is. Net assessment: a high-barrier, low-impact authorization flaw affecting only the remote-cluster/shared-channels feature - a patch-in-normal-cycle item, not an emergency.

An attacker who has already captured a remote-cluster invite token (e.g., from logs, interception, or a prior leak) reuses it against a Mattermost server still running the legacy version 1 remote-cluster protocol, or against a confirming party that did not supply a refreshed token. Because the server fails to invalidate the token after legitimate confirmation, the attacker authenticates as the remote cluster and performs a limited set of actions on shared channels. No public exploit code is known, and the high attack complexity plus token prerequisite make this an opportunistic rather than mass-exploitable scenario.