CVE-2025-13324

Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

CVSS 3.7 LOWEPSS 0.2%CWE-863

Vexday Risk Score

8Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 3.7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

17 Dec 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Mattermost · Mattermost

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://mattermost.com/security-updates