Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server
Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server
02 / AFFECTED SOFTWARE
Affected packages
59 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.
05 / REFERENCES
Further evidence
- https://github.com/advisories/GHSA-mc2f-jgj6-6cp3
- https://github.com/mattermost/mattermost/commit/65343f84a7830fa8078fe3df879fca924e4fac01
- https://mattermost.com/security-updates
- https://nvd.nist.gov/vuln/detail/CVE-2025-3230
- https://github.com/mattermost/mattermost
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3230.json