Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Summary

Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

Timeline

1. Dec 17, 2025, 6:14 PM UTCCVE published
2. Dec 17, 2025, 6:52 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Dec 24, 2025, 10:16 AM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 10.11.0 · through 10.11.5; From 11.0.0 · through 11.0.4; From 10.12.0 · through 10.12.2

• github.com/mattermost/mattermostGo

  From 10.12.0 · fixed in 10.12.2

• github.com/mattermost/mattermostGo

  From 10.11.0-rc1 · fixed in 10.11.5

• github.com/mattermost/mattermostGo

  From 11.0.0-alpha.1 · fixed in 11.0.4

• github.com/mattermost/mattermost/server/v8Go

  fixed in 8.0.0-20251031095924-e7e23b94e006

• github.com/mattermost/mattermost-serverGo

  fixed in 11.0.4

• github.com/mattermost/mattermostGo

  From 10.11.0-rc1+incompatible · fixed in 10.11.5+incompatible; From 10.12.0+incompatible · fixed in 10.12.2+incompatible; From 11.0.0-alpha.1+incompatible · fixed in 11.0.4+incompatible

• github.com/mattermost/mattermost-serverGo

  fixed in 11.0.4+incompatible

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

References 1