Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

published 2025-05-30 17 mo ago modified 2026-06-17 4 mo ago also GHSA-mc2f-jgj6-6cp3 , GO-2025-3731 , EUVD-2025-16491

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Patch / fix

fixed in 3 distros 1 links 1

go github.com/mattermost/mattermost/server/v8 8.0.0-20250402193107-65343f84a783, 9.11.13, 10.5.4, 10.6.3, 10.7.1
go github.com/mattermost/mattermost-server 9.11.13+incompatible, 10.5.4+incompatible, 10.6.3+incompatible, 10.7.1+incompatible
Mattermost Mattermost 9.11.13, 10.5.4, 10.6.3, 10.7.1, 10.8.0

govulncheck-vulndb openSUSE Tumbleweed 0.0.20250612T141001-1.1

opensuse advisories openSUSE-SU-2025:15225-1

github.com/mattermost/mattermost@65343f8 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 17 mo ago (2025-05-30)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
GitHub	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/mattermost/mattermost/server/v8	>=10.7.0-rc1, <10.7.1 >=10.6.0-rc1, <10.6.3 >=10.0.0-rc1, <10.5.4 >=9.0.0-rc1, <9.11.13 <8.0.0-20250402193107-65343f84a783	10.7.1 10.6.3 10.5.4 9.11.13 8.0.0-20250402193107-65343f84a783
go	github.com/mattermost/mattermost-server	>=9.0.0-rc1+incompatible, <9.11.13+incompatible >=10.0.0-rc1+incompatible, <10.5.4+incompatible >=10.6.0-rc1+incompatible, <10.6.3+incompatible >=10.7.0-rc1+incompatible, <10.7.1+incompatible	9.11.13+incompatible 10.5.4+incompatible 10.6.3+incompatible 10.7.1+incompatible
go	github.com/mattermost/mattermost-server/v5	all versions	no fix listed
go	github.com/mattermost/mattermost-server/v6	all versions	no fix listed

Affected products

Mattermost Mattermost

Classification

Weakness

CWE-303 Incorrect Implementation of Authentication Algorithm

References

github.com /mattermost/mattermost/commit/65343f84a7830fa8078fe3df879fca924e4fac01
web
mattermost.com /security-updates
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2025-3230
advisory
github.com /mattermost/mattermost
package
github.com /advisories/GHSA-mc2f-jgj6-6cp3
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary