CVE-2025-41410

published 2025-10-16

CVE-2025-41410: Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows…

Priority P3 35 medium 5.4 CVSS 3.1

AV N AC L PR L UI N S U C L I L A N

Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions

Affected

13 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 10.10.0 < 10.10.3	10.10.3
github.com	mattermost_mattermost-server	>= 10.10.0+incompatible < 10.10.3+incompatible	10.10.3+incompatible
github.com	mattermost_mattermost-server	>= 10.11.0 < 10.11.3	10.11.3
github.com	mattermost_mattermost-server	>= 10.11.0+incompatible < 10.11.3+incompatible	10.11.3+incompatible
github.com	mattermost_mattermost-server	>= 10.5.0 < 10.5.11	10.5.11
github.com	mattermost_mattermost-server	>= 10.5.0+incompatible < 10.5.11+incompatible	10.5.11+incompatible
github.com	mattermost_mattermost_server_v8	>= 0 < 8.0.0-20250822083415-01b95392a450	8.0.0-20250822083415-01b95392a450
mattermost	mattermost	10.10.0 – 10.10.2	—
mattermost	mattermost	10.11.0 – 10.11.2	—
mattermost	mattermost	10.5.0 – 10.5.10	—
mattermost	mattermost_server	>= 10.10.0 < 10.10.3	10.10.3
mattermost	mattermost_server	>= 10.11.0 < 10.11.3	10.11.3
mattermost	mattermost_server	>= 10.5.0 < 10.5.11	10.5.11

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862