Cloudanix VulnDB

CVE-2025-13324

Medium · 4.3

Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

CVSS

4.3

EPSS

0.2%

Published

Dec 17, 2025

CISA due date

—

The record

Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate invite tokens after use which allows malicious actors who have intercepted invite tokens to manipulate channel memberships including adding or removing users from private channels via token replay attack.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/mattermost/mattermost 10.11.0-rc1 10.11.5
Go github.com/mattermost/mattermost 10.11.0-rc1+incompatible 10.11.5+incompatible
Go github.com/mattermost/mattermost 10.12.0 10.12.2
Go github.com/mattermost/mattermost 11.0.0-alpha.1 11.0.4
Go github.com/mattermost/mattermost-server 0 11.0.4+incompatible
Go github.com/mattermost/mattermost-server 0 11.0.4
Go github.com/mattermost/mattermost-server/v5 0 No fix
Go github.com/mattermost/mattermost-server/v6 0 No fix
Go github.com/mattermost/mattermost/server/v8 0 8.0.0-20251031095924-e7e23b94e006
go github.com/mattermost/mattermost 10.11.0-rc1 10.11.5
go github.com/mattermost/mattermost 10.12.0 10.12.2
go github.com/mattermost/mattermost 11.0.0-alpha.1 11.0.4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251230T014957-150000.1.134.1

Related vulnerabilities