Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation
Vulnerability Description
Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13324
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- daw10
References
More from Mattermost
View All →Affected Vendor
Mattermost
View all reports →