Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
Priority LOW 17CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00199 9th percentileScored 2026-11-07
Fix Fixed Mattermost (Mattermost): 11.1.0, 10.11.6, 11.0.5 +1github.com/mattermost/mattermost (Go): 10.12.2, 10.11.5, 11.0.4+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mattermost | Mattermost | 10.11.0 – 10.11.5; 11.0.0 – 11.0.4; 10.12.0 – 10.12.2 | 11.1.0, 10.11.6, 11.0.5, 10.12.3 | Patch available | CNA |
| — | github.com/mattermost/mattermost (Go) | 10.12.0 to before 10.12.2 | 10.12.2 | Patch available | GHSA-x3r8-2hmh-89f5 |
| — | github.com/mattermost/mattermost (Go) | 10.11.0-rc1 to before 10.11.5 | 10.11.5 | Patch available | GHSA-x3r8-2hmh-89f5 |
| — | github.com/mattermost/mattermost (Go) | 11.0.0-alpha.1 to before 11.0.4 | 11.0.4 | Patch available | GHSA-x3r8-2hmh-89f5 |
| — | github.com/mattermost/mattermost/server/v8 (Go) | before 8.0.0-20251031095924-e7e23b94e006 | 8.0.0-20251031095924-e7e23b94e006 | Patch available | GHSA-x3r8-2hmh-89f5 |
| — | github.com/mattermost/mattermost-server (Go) | before 11.0.4 | 11.0.4 | Patch available | GHSA-x3r8-2hmh-89f5 |
- Mattermost VendorMattermost Affected 10.11.0 – 10.11.5; 11.0.0 – 11.0.4; 10.12.0 – 10.12.2 Fixed in 11.1.0, 10.11.6, 11.0.5, 10.12.3 Patch available CNA
- github.com/mattermost/mattermost (Go) Vendor— Affected 10.12.0 to before 10.12.2 Fixed in 10.12.2 Patch available GHSA-x3r8-2hmh-89f5
- github.com/mattermost/mattermost (Go) Vendor— Affected 10.11.0-rc1 to before 10.11.5 Fixed in 10.11.5 Patch available GHSA-x3r8-2hmh-89f5
- github.com/mattermost/mattermost (Go) Vendor— Affected 11.0.0-alpha.1 to before 11.0.4 Fixed in 11.0.4 Patch available GHSA-x3r8-2hmh-89f5
- github.com/mattermost/mattermost/server/v8 (Go) Vendor— Affected before 8.0.0-20251031095924-e7e23b94e006 Fixed in 8.0.0-20251031095924-e7e23b94e006 Patch available GHSA-x3r8-2hmh-89f5
- github.com/mattermost/mattermost-server (Go) Vendor— Affected before 11.0.4 Fixed in 11.0.4 Patch available GHSA-x3r8-2hmh-89f5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* | 10.11.0 to before 10.11.6; 10.12.0 to before 10.12.3; 11.0.0 to before 11.0.5 | Vulnerable | Mattermost |
- cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* Versions 10.11.0 to before 10.11.6; 10.12.0 to before 10.12.3; 11.0.0 to before 11.0.5 Vulnerable ·Mattermost
Remediation
- Fix · CNA Mattermost (Mattermost) Fixed in 11.1.0, 10.11.6, 11.0.5, 10.12.3
- Fix · GHSA-x3r8-2hmh-89f5 github.com/mattermost/mattermost (Go) Fixed in 10.12.2 Advisory →
- Fix · GHSA-x3r8-2hmh-89f5 github.com/mattermost/mattermost (Go) Fixed in 10.11.5 Advisory →
- Fix · GHSA-x3r8-2hmh-89f5 github.com/mattermost/mattermost (Go) Fixed in 11.0.4 Advisory →
- Fix · GHSA-x3r8-2hmh-89f5 github.com/mattermost/mattermost/server/v8 (Go) Fixed in 8.0.0-20251031095924-e7e23b94e006 Advisory →
- Fix · GHSA-x3r8-2hmh-89f5 github.com/mattermost/mattermost-server (Go) Fixed in 11.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13324
- 2026-10-03 Alias added: GHSA-x3r8-2hmh-89f5
References
Other 4
- https://github.com/mattermost/mattermost/commit/364c2203de00fe0d8424b6b46d6f0eeb02a2539a
- https://github.com/mattermost/mattermost/commit/7ccb62db7958abd6a4b21a06c5a4f5367a8f8b1f
- https://github.com/mattermost/mattermost/commit/9f54e5cdc3aef412945ff0e6a58338f7b549bdda
- https://github.com/mattermost/mattermost
More Mattermost Server vulnerabilities
- TI-2025-18933 Arbitrary file read in Mattermost Boards via import & export board archive CVSS 3.1CRITICAL 9.9
- TI-2025-04465 Path Traversal Leading to RCE by Any Authenticated Mattermost User CVSS 3.1CRITICAL 9.9
- TI-2017-14068 An issue was discovered in Mattermost Server before 3.6.2. CVSS 3.1CRITICAL 9.8
- TI-2017-14060 An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. CVSS 3.1CRITICAL 9.8
- TI-2017-14048 An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. CVSS 3.1CRITICAL 9.8
- TI-2025-14360 Arbitrary file read via block duplication in Mattermost Boards CVSS 3.1CRITICAL 9.9
Sources
- CVE-2025-13324 · CVE Program
- CVE-2025-13324 · NVD
- FIRST EPSS
- GHSA-x3r8-2hmh-89f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences