VULNERABILITY INTELLIGENCE

CVE-2025-13324

CVSS score3.7 LOW
EPSS probability0.20%
CISA KEVNot currently listed
Published2025-12-17
Last modified2026-10-13
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-863

Primary references