CVE-2025-58075
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Résumé
Arbitrary Mattermost Team can be joined by manipulating the SAML RelayState
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- web mattermost.com