CVE-2025-13324
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mattermost
- Vendor
- Mattermost
- Product
- Mattermost
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 10.11.0 | affected | semver | Unavailable | 10.11.5 | None listed |
| 11.0.0 | affected | semver | Unavailable | 11.0.4 | None listed |
| 10.12.0 | affected | semver | Unavailable | 10.12.2 | None listed |
| 11.1.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.11.6 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.0.5 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.12.3 | unaffected | Unavailable | Unavailable | Unavailable | None listed |