CVE-2025-6227

LOW

2.2

Description

Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

CVE Details

CVSS v3.1 Score2.2

SeverityLOW

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredHIGH

User InteractionNONE

Published7/18/2025

Last Modified10/14/2025

Sourcenvd

Honeypot Sightings0

Affected Products

mattermost:mattermost_server

Weaknesses (CWE)

CWE-522

References

https://mattermost.com/security-updates(responsibledisclosure@mattermost.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.