CVE-2025-58073
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Résumé
Arbitrary Mattermost Team can be joined by manipulating the OAuth state
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com