CVE-2025-58075

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.5.x through 10.5.10 Mattermost versions 10.10.x through 10.10.2 Mattermost versions 10.11.x through 10.11.1

Description A flaw exists in Mattermost where the system does not properly verify a user’s permission to join a team using an invite token. This allows an attacker to join any team on a Mattermost server, bypassing restrictions through manipulation of the RelayState parameter. The issue involves improper validation of user permissions when joining a team via an invite token.

Recommendations Update Mattermost to a version later than 10.5.10 Update Mattermost to a version later than 10.10.2 Update Mattermost to a version later than 10.11.1