CVE-2025-6227

Published Jul 18, 2025

Last updated 9 hours ago

Overview

Description: Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
Source: responsibledisclosure@mattermost.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 2.2
Impact score: 1.4
Exploitability score: 0.7
Vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Severity: LOW

Weaknesses

responsibledisclosure@mattermost.com: CWE-522

Hype score: Not currently trending

CVE-2025-6227 Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and pass… https://t.co/td87arPlxB
@CVEnew
18 Jul 2025
350 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes

References

Sources include official advisories and independent security research.