CVE-2025-6227: Invite token is used as part of the secure communication
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.0.0-20250612074655-8f8612c63783 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 9.11.17 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.5.8 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.5.8 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 9.11.17 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.9.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6227?
CVE-2025-6227 is considered a high severity vulnerability due to its potential for exploitation via intercepted tokens.
How do I fix CVE-2025-6227?
To fix CVE-2025-6227, update your Mattermost installation to version 10.5.8 or 9.11.17 or later.
What versions of Mattermost are affected by CVE-2025-6227?
CVE-2025-6227 affects Mattermost versions 10.5.x up to 10.5.7 and 9.11.x up to 9.11.16.
What is the impact of CVE-2025-6227?
The impact of CVE-2025-6227 allows an attacker to send unauthorized synchronization payloads to the Mattermost server.
Can CVE-2025-6227 be exploited remotely?
Yes, CVE-2025-6227 can potentially be exploited remotely if an attacker gains access to the intercepted invite and password.