CVE-2025-3230CWE-303

Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Medium · published May 30, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.7th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2025-05-30T14:22Z
EPSS history
Timeline
  • 30 MAY 14:22Z
    Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server
    cvelistv5