Mattermost Server
CVE-2025-58073
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitManipulate OAuth state parameter with invite token
-
ExecutionBypass team-join authorization check
-
ImpactJoin restricted team and access its content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated account on the target Mattermost server (CVSS PR:L) and that the server uses the OAuth-based join flow whose state parameter carries the original invite token. The attacker manipulates that OAuth state so the server reuses the invite token without re-checking team-join permissions, defeating team membership restrictions. Exploitation is limited by the need for prior authentication and by affected version exposure (10.11.x ≤ 10.11.1, 10.10.x ≤ 10.10.2, 10.5.x ≤ 10.5.10); it does not grant pre-authentication access and has no impact on availability. |
| Impact | This is a genuine authorization flaw (CWE-862, Missing Authorization) in Mattermost Server with meaningful real-world risk, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates network-reachable exploitation at low complexity by an already-authenticated low-privilege user, with no user interaction, yielding high confidentiality and integrity impact but no availability impact. No EPSS score, KEV listing, POC reference, or SSVC decision data was supplied in the input, so exploitation likelihood cannot be quantified from probabilistic signals - per precision rules this is scored as no public exploit identified at time of analysis. The signals are internally consistent: PR:L correctly reflects that an attacker must hold a valid server account before manipulating the OAuth state to bypass team-join restrictions, so this is not a pre-auth mass-exploitation bug. Net: a real priority for multi-tenant/multi-team Mattermost deployments that rely on team membership restrictions for data segregation, but materially gated by the authenticated-access prerequisite rather than a drive-by remote threat. |
| Exploit ScenarioDerived | A low-privilege but authenticated user on a shared Mattermost server initiates an OAuth login/join flow and tampers with the OAuth state parameter so the server reuses the original invite token without re-verifying team-join permissions. The attacker thereby joins teams they were never invited to or are restricted from, gaining read/write access to those teams' channels and content. No public exploit code was identified in the provided data, and exploitation requires a valid account on the target server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Mattermost Server 10.11.x through 10.11.1, 10.10.x through 10.10.2, and 10.5.x through 10.5.10 contains a missing authorization flaw that allows an authenticated user to bypass team-join restrictions by manipulating the OAuth state parameter so the server reuses the original invite token without rechecking permissions. This lets an attacker with a valid account join teams they should not access, with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; exploitation depends on a valid account and an OAuth-based join flow that carries the invite token in state.
RemediationAI
Patch available per vendor advisory: apply the fixed Mattermost Server release identified at https://mattermost.com/security-updates for your release line; the affected ranges are 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, and 10.5.x <= 10.5.10, so move to a vendor-designated release outside those ranges. If upgrading immediately is not possible, disable or restrict OAuth-based team-join and invite flows that carry the original invite token in OAuth state, for example by requiring administrator-managed invitations, accepting that self-service OAuth team joining will be unavailable and administrative overhead will increase; also review team membership and invite-token usage logs for unexpected joins. The CVSS vector requires a valid authenticated account, so limiting account issuance and reviewing existing accounts reduces exposure but does not replace the fix.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Mattermost Server, identified by CPE cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* across the 10.11.x, 10.10.x, and 10.5.x release lines at or below 10.11.1, 10.10.2, and 10.5.10 respectively. The root cause is CWE-862 Missing Authorization: in an OAuth-based team-join flow, the OAuth state parameter carries the original invite token, and the server fails to verify that the authenticated user has permission to join the target team before accepting that token. An attacker with a valid Mattermost account (CVSS PR:L, AV:N/AC:L/UI:N) can tamper with the OAuth state so the invite token is reused without a fresh authorization check, defeating team membership restrictions. The CVSS vector indicates high confidentiality and integrity impact with no availability impact and unchanged scope; the flaw does not provide pre-authentication access. Mattermost's advisory at https://mattermost.com/security-updates is the authoritative reference.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Authenticated low-privilege user (PR:L) exploits a server-side authorization gap remotely with no interaction; joining restricted teams exposes and lets them alter team data (C:H/I:H), no availability impact.
Primary rating from Vendor (mattermost).
CVSS VectorVendor: mattermost
DescriptionCVE.org
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
Executive ViewAI
Mattermost Server versions 10.11.x through 10.11.1, 10.10.x through 10.10.2, and 10.5.x through 10.5.10 contain an authorization flaw that can let a valid account holder join teams they are not entitled to. This creates a high risk of unauthorized access to team content and unauthorized changes, making access governance and data protection the immediate leadership concerns; no public exploit was identified at time of analysis.
Interim mitigations include restricting or disabling OAuth-based team-join flows, requiring administrative approval for team joins, auditing team membership and removing unauthorized joins, enforcing least privilege for sensitive teams, and monitoring team-join and OAuth logs; no vendor-released patch is identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
GitHub PoC
Exploit-DB