GHSA-mc2f-jgj6-6cp3

Source

https://github.com/advisories/GHSA-mc2f-jgj6-6cp3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-mc2f-jgj6-6cp3/GHSA-mc2f-jgj6-6cp3.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-mc2f-jgj6-6cp3

Aliases

CVE-2025-3230
GO-2025-3731

Published

2025-05-30T15:30:32Z

Modified

2025-06-03T18:44:22.427960Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Mattermost fails to properly invalidate personal access tokens upon user deactivation

Details

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

Database specific

{
    "nvd_published_at": "2025-05-30T15:15:41Z",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-30T18:48:27Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-303"
    ]
}

References

Affected packages

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

10.7.0-rc1

Fixed

10.7.1

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

10.6.0-rc1

Fixed

10.6.3

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

10.0.0-rc1

Fixed

10.5.4

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0-rc1

Fixed

9.11.13

Go / github.com/mattermost/mattermost/server/v8

Package

Name: github.com/mattermost/mattermost/server/v8; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.0.0-20250402193107-65343f84a783