LDAP Injection in Mattermost Enterprise Edition When Using Active Directory

Summary

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Timeline

1. Jun 11, 2025, 10:22 AM UTCCVE published
2. Jun 11, 2025, 1:13 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 11, 2025, 1:13 PM UTCRecord last updated

Affected versions

• Mattermost Mattermost

  From 10.7.0 · through 10.7.1; From 10.6.0 · through 10.6.3; From 10.5.0 · through 10.5.4; From 9.11.0 · through 9.11.13

• github.com/mattermost/mattermost-serverGo

  From 9.11.0+incompatible · fixed in 9.11.14+incompatible; From 10.5.0+incompatible · fixed in 10.5.5+incompatible; From 10.6.0+incompatible · fixed in 10.6.4+incompatible; From 10.7.0+incompatible · fixed in 10.7.2+incompatible

• github.com/mattermost/mattermost-server/v5Go

  All versions

• github.com/mattermost/mattermost-server/v6Go

  All versions

• github.com/mattermost/mattermost/server/v8Go

  fixed in 8.0.0-20250414112942-77892234944b

• github.com/mattermost/mattermost-serverGo

  From 10.7.0 · fixed in 10.7.2

• github.com/mattermost/mattermost-serverGo

  From 10.6.0 · fixed in 10.6.4

• github.com/mattermost/mattermost-serverGo

  From 10.5.0 · fixed in 10.5.5

• github.com/mattermost/mattermost-serverGo

  From 9.11.0 · fixed in 9.11.14

References 1