CVE-2025-58073
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Summary
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Original description
The description as published by the source.
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com