CVE-2025-58075
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Summary
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Original description
The description as published by the source.
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com