GitHub Advisoryadvisory · Go

GHSA-mc2f-jgj6-6cp3 Mattermost fails to properly invalidate personal access tokens upon user deactivation

MEDIUM Published 2025-05-30 Modified 2025-05-30 Official page ↗
Aliases
CVE-2025-3230
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-303
Reviewed
2025-05-30

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 10.7.0-rc1, < 10.7.1 → fixed in 10.7.1 • Go github.com/mattermost/mattermost/server/v8: >= 10.6.0-rc1, < 10.6.3 → fixed in 10.6.3 • Go github.com/mattermost/mattermost/server/v8: >= 10.0.0-rc1, < 10.5.4 → fixed in 10.5.4 • Go github.com/mattermost/mattermost/server/v8: >= 9.0.0-rc1, < 9.11.13 → fixed in 9.11.13 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20250402193107-65343f84a783 → fixed in 8.0.0-20250402193107-65343f84a783

Description

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Related

Alias · CVE (1)

  • CVE-2025-3230 Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access… vulnerability

Weakness · CWE (1)

  • CWE-303 Incorrect Implementation of Authentication Algorithm weakness

References