Listen to this Post
How the CVE Works
Mattermost versions 10.5.x <= 10.5.7 and 9.11.x <= 9.11.16 fail to regenerate authentication tokens when accepting team invites. This flaw allows an attacker who intercepts both the invite link and the user’s password to abuse the REST API by sending synchronization payloads to the server that generated the invite. The insufficient credential rotation enables unauthorized API calls, potentially leading to unauthorized data access or manipulation.
DailyCVE Form
Platform: Mattermost
Version: 10.5.x <= 10.5.7, 9.11.x <= 9.11.16
Vulnerability: Credential Reuse
Severity: Low
Date: Jul 18, 2025
Prediction: Patch expected by Aug 15, 2025
What Undercode Say
Analytics:
curl -X GET "https://api.mattermost.com/v4/teams/invite/status" -H "Authorization: Bearer <token>"
import requests
response = requests.post("https://mattermost-server/api/v4/sync", headers={"Auth": "compromised_token"})
How Exploit
Intercept invite & password → Reuse token → Send unauthorized sync requests via REST API.
Protection from this CVE
Update to patched versions. Enforce token regeneration.
Impact
Unauthorized API access. Data leakage.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
