VDB
CVE-2025-13324
CVE-2025-13324
PUBLISHED
CVSS 3.7 LOW
Reported by Mattermost · Published December 17, 2025
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
Risk Scores
CVSS 3.1
3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 10.11.0, 11.0.0, 10.12.0 |
| Mattermost | Mattermost | 10.11.0, 11.0.0, 10.12.0 |
Timeline
- Nov 17, 2025 CVE ID Reserved
- Dec 17, 2025 CVE Published
- Dec 18, 2025 EPSS Score
- Dec 22, 2025 EPSS Score
- Dec 24, 2025 CVE Updated
- Dec 27, 2025 EPSS Score
- Dec 31, 2025 EPSS Score
- Jan 4, 2026 EPSS Score
- Jan 9, 2026 EPSS Score
- Jan 13, 2026 EPSS Score
- Jan 17, 2026 EPSS Score
- Jan 21, 2026 EPSS Score