CVE-2025-3230

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

M

attermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

15 Oct 2025, 14:16

Type	Values Removed	Values Added
First Time		Mattermost Mattermost mattermost Server
Summary		(es) Las versiones de Mattermost 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 no invalidan correctamente los tokens de acceso personal tras la desactivación del usuario, lo que permite que los usuarios desactivados mantengan acceso completo al sistema explotando fallas de validación de tokens de acceso mediante el uso continuo de tokens emitidos previamente.
References	~~() https://mattermost.com/security-updates -~~	() https://mattermost.com/security-updates - Vendor Advisory
CPE		cpe:2.3:a:mattermost:mattermost_server::::::::

30 May 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-30 15:15

Updated : 2025-10-15 14:16

NVD link : CVE-2025-3230

Mitre link : CVE-2025-3230

CVE.ORG link : CVE-2025-3230

JSON object : View

Products Affected

mattermost_server

CWE

CWE-303

Incorrect Implementation of Authentication Algorithm

{"id": "CVE-2025-3230", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-05-30T15:15:41.043", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-303"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens."}, {"lang": "es", "value": "Las versiones de Mattermost 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 no invalidan correctamente los tokens de acceso personal tras la desactivaci\u00f3n del usuario, lo que permite que los usuarios desactivados mantengan acceso completo al sistema explotando fallas de validaci\u00f3n de tokens de acceso mediante el uso continuo de tokens emitidos previamente."}], "lastModified": "2025-10-15T14:16:49.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC431F02-E096-4994-9CB3-AC2DB1C7FAB5", "versionEndExcluding": "9.11.13", "versionStartIncluding": "9.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EB2F235-4072-4E5E-914C-07829E12A481", "versionEndExcluding": "10.5.4", "versionStartIncluding": "10.5.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C12F8F0-C3CD-4508-8162-AE2523E0836B", "versionEndExcluding": "10.6.3", "versionStartIncluding": "10.6.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A7C1EB8-01C3-4449-A3D2-3C25B4334032", "versionEndExcluding": "10.7.1", "versionStartIncluding": "10.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}