CVE-2025-3230 MEDIUM

CVE-2025-3230: Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server

Vendor Mattermost
Product Mattermost
Weakness CWE-303
Published May 30, 2025
Last update May 30, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Key dates

02Disclosure timeline

May 30, 2025 CVE published
May 30, 2025 Record updated