CVEvulnerability

CVE-2025-3230

5.4 MEDIUM Published 2025-05-30 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-303

Description

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Affected configurations

• mattermost mattermost server (>= 9.11.0 < 9.11.13) • mattermost mattermost server (>= 10.5.0 < 10.5.4) • mattermost mattermost server (>= 10.6.0 < 10.6.3) • mattermost mattermost server (>= 10.7.0 < 10.7.1)

Related

Weakness · CWE (1)

  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness

References