Mattermost Server CVE-2025-58075

The attacker must already possess a valid authenticated account on the target Mattermost server (CVSS PR:L), and the attack operates against the invite-based team-join flow by manipulating the RelayState value associated with the original invite token - a construct tied to SAML/SSO handling. The server's failure to re-verify team-join authorization lets the attacker join any team regardless of its join restrictions. Limiting factors: exploitation requires an existing account (not anonymous), targets a server that uses the affected invite/SSO join mechanism, and only affects the listed versions (10.11.x ≤ 10.11.1, 10.10.x ≤ 10.10.2, 10.5.x ≤ 10.5.10); impact is confined to unauthorized team membership and its data (no availability impact).

This is a genuine but conditional priority, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity attack requiring only low privileges (PR:L - an existing, authenticated low-level account) and no user interaction, with high confidentiality and integrity impact but no availability impact. This aligns well with CWE-862 (Missing Authorization): the server fails to verify team-join permission when the original invite token's RelayState is manipulated. No EPSS score, SSVC decision, KEV listing, or POC reference was supplied, so exploitation-likelihood signals are entirely absent - the 8.1 is a theoretical base severity with no corroborating real-world exploitation evidence at this time. The limiting factor that tempers the score is PR:L: an attacker must already hold a valid account on the target server, making this an insider/account-holder privilege-escalation-of-scope issue (crossing team boundaries) rather than a fully anonymous remote takeover. Net: real and worth patching promptly for any multi-team Mattermost deployment with sensitive team segregation, but the lack of EPSS/KEV/POC data means this should be treated as a confirmed-by-vendor authorization flaw of moderate-to-high priority, not an actively-exploited crisis. No conflicting signals were detected between the vector and the description.

An authenticated low-privilege user on a Mattermost server intercepts or reuses the RelayState value tied to an original team invite token and manipulates it during the join flow. Because the server never re-checks whether the user is permitted to join that team, the attacker is added to any team on the server - including restricted ones - gaining read/write access to its channels and content. No public exploit code was identified at time of analysis, and the attack requires an existing account on the target instance.