CVE-2025-13324
published 2025-12-17CVE-2025-13324: Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1)…
PriorityP417low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.17%
7.0th percentile
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost | >= 10.11.0-rc1 < 10.11.5 | 10.11.5 |
| github.com | mattermost_mattermost | >= 10.11.0-rc1+incompatible < 10.11.5+incompatible | 10.11.5+incompatible |
| github.com | mattermost_mattermost | >= 10.12.0 < 10.12.2 | 10.12.2 |
| github.com | mattermost_mattermost | >= 10.12.0+incompatible < 10.12.2+incompatible | 10.12.2+incompatible |
| github.com | mattermost_mattermost | >= 11.0.0-alpha.1 < 11.0.4 | 11.0.4 |
| github.com | mattermost_mattermost | >= 11.0.0-alpha.1+incompatible < 11.0.4+incompatible | 11.0.4+incompatible |
| github.com | mattermost_mattermost-server | >= 0 < 11.0.4 | 11.0.4 |
| github.com | mattermost_mattermost-server | >= 0 < 11.0.4+incompatible | 11.0.4+incompatible |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20251031095924-e7e23b94e006 | 8.0.0-20251031095924-e7e23b94e006 |
| mattermost | mattermost | 10.11.0 – 10.11.5 | — |
| mattermost | mattermost | 10.12.0 – 10.12.2 | — |
| mattermost | mattermost | 11.0.0 – 11.0.4 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.6 | 10.11.6 |
| mattermost | mattermost_server | >= 10.12.0 < 10.12.3 | 10.12.3 |
| mattermost | mattermost_server | >= 11.0.0 < 11.0.5 | 11.0.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost
osv·2025-12-30
CVE-2025-13324 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost
OSV
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation
osv·2025-12-17
CVE-2025-13324 [MEDIUM] Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
GHSA
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation
ghsa·2025-12-17
CVE-2025-13324 [MEDIUM] CWE-863 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation
Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
No detection rules found.
No public exploits indexed.
2025-12-17
Published