Mattermost Server CVE-2025-41410

Exploitation specifically requires the ability to perform or supply data to the Mattermost Slack import process and requires that the target deployment relies on email-domain-based team access restrictions for the bypass to have meaning. The vulnerable path is the Slack import feature's failure to validate email ownership, allowing attacker-controlled import data to mint pre-verified accounts for arbitrary email domains. Limiting factors: the attacker must have an account with sufficient privilege to run an import (the CVSS encodes PR:L, but Slack import is generally a team/system admin function, likely a stronger barrier than PR:L suggests); no end-user interaction is required (UI:N); and the impact is confined to bypassing email/domain team-access controls (Low confidentiality and integrity, no availability impact) rather than full account or server takeover. Affected only on Mattermost Server builds 10.5.x <=10.5.10, 10.10.x <=10.10.2, and 10.11.x <=10.11.2.

This is a moderate-severity authorization flaw (CVSS 5.4, CWE-862 Missing Authorization) that is realistically a low-to-moderate operational priority rather than an urgent emergency. Supporting this: EPSS is only 0.30% (22nd percentile), indicating low predicted exploitation probability; there is no CISA KEV listing and no public exploit identified at time of analysis; and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) already reflects limited impact with only Low confidentiality and integrity and no availability effect. The key tension is in the privilege requirement: the CVSS vector encodes PR:L (authenticated, low privilege), yet the vulnerable action - performing a Slack import - is typically an administrative/team-admin operation in Mattermost, which would argue for a higher real-world privilege barrier than PR:L implies; verify the exact role required with the Mattermost advisory. The attack vector is network (AV:N) and complexity is low (AC:L), but exploitation is gated behind the ability to supply malicious Slack import data, which is not something an anonymous external attacker can normally do. Net: a genuine security-restriction bypass worth patching on a normal cycle, but not a high-urgency, widely-exploited threat.

An attacker who can submit Slack import data to a Mattermost server crafts malicious import content that asserts ownership of email addresses under a trusted/arbitrary domain. Because the import process fails to validate email ownership, the import creates pre-verified accounts for those addresses, letting the attacker bypass email-domain-based team access restrictions and gain membership in otherwise restricted teams. No public exploit code was identified at the time of analysis, and exploitation requires the ability to run or supply a Slack import.