High · published October 16, 2025
⚡ Just by manipulating the OAuth state, an attacker can join any Mattermost team with a single invite token! Think of it like a buffet where anyone can sneak in and grab a plate, bypassing the guest list entirely. The server fails to check if the newcomer is really supposed to be there! This vulnerability is a game-changer! If someone abused this flaw, they could waltz into any team on your Mattermost server, accessing private conversations and sensitive information. Imagine the chaos if a malicious intruder started lurking in your teams — absolutely devastating!
Think of it like a buffet where anyone can sneak in and grab a plate, bypassing the guest list entirely. The server fails to check if the newcomer is really supposed to be there! Mattermost versions 10.11.x up to 10.11.1, 10.10.x up to 10.10.2, and 10.5.x up to 10.5.10 lack proper permission verification for joining teams via invite tokens, allowing unauthorized access through manipulated OAuth states.
This vulnerability is a game-changer! If someone abused this flaw, they could waltz into any team on your Mattermost server, accessing private conversations and sensitive information. Imagine the chaos if a malicious intruder started lurking in your teams — absolutely devastating! Patch to Mattermost version 10.11.2, 10.10.3, or 10.5.11 immediately to close this gap. Review your team permissions and consider implementing additional logging to monitor for any unauthorized access attempts. You've got this! Follow these steps, and you'll have your Mattermost server shielded in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mattermost/mattermost_server | ≥ 10.5.0, < 10.5.11 | 10.5.11 |
| mattermost/mattermost_server | ≥ 10.10.0, < 10.10.3 | 10.10.3 |
| mattermost/mattermost_server | ≥ 10.11.0, < 10.11.3 | 10.11.3 |