CVE-2025-13324: Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
Other sources
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13324?
CVE-2025-13324 is classified as a high-severity vulnerability due to its potential for unauthorized access to private channel memberships.
How do I fix CVE-2025-13324?
To fix CVE-2025-13324, upgrade your Mattermost installation to version 10.11.6, 11.0.5, or 10.12.3 or later.
What versions of Mattermost are affected by CVE-2025-13324?
CVE-2025-13324 affects Mattermost versions 10.11.x up to 10.11.5, 11.0.x up to 11.0.4, and 10.12.x up to 10.12.2.
What is the impact of CVE-2025-13324?
The impact of CVE-2025-13324 allows adversaries to manipulate private channel memberships using intercepted invite tokens.
Is there a workaround for CVE-2025-13324?
Currently, the recommended action is to upgrade Mattermost to a patched version, as no specific workaround is provided.