Vulnerability in Mattermost
CVE-2025-3230
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.
EPSS: 0.002 (8.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Mattermost — versions 10.7.0, 10.6.0, 10.5.0
- Mattermost Mattermost_server
Weakness classification (CWE)
Public proof-of-concept exploits
References
- responsibledisclosure@mattermost.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-3230?
- CVE-2025-3230 is a medium-severity vulnerability in Mattermost, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 5.4/10. Published 2025-05-30.
- How severe is CVE-2025-3230?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2025-3230 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.