Skip to content

x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-mc2f-jgj6-6cp3 #3731

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/mattermost/mattermost/server/v8: GHSA-mc2f-jgj6-6cp3#3731
Assignees
thatnealpatel
Labels
triaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on May 30, 2025

Advisory GHSA-mc2f-jgj6-6cp3 references a vulnerability in the following Go modules:

Module
github.com/mattermost/mattermost-server
github.com/mattermost/mattermost-server/v5
github.com/mattermost/mattermost-server/v6
github.com/mattermost/mattermost/server/v8

Description:
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/mattermost/mattermost-server
      versions:
        - introduced: 9.0.0-rc1+incompatible
        - fixed: 9.11.13+incompatible
        - introduced: 10.0.0-rc1+incompatible
        - fixed: 10.5.4+incompatible
        - introduced: 10.6.0-rc1+incompatible
        - fixed: 10.6.3+incompatible
        - introduced: 10.7.0-rc1+incompatible
        - fixed: 10.7.1+incompatible
      vulnerable_at: 10.7.0+incompatible
    - module: github.com/mattermost/mattermost-server/v5
      vulnerable_at: 5.39.3
    - module: github.com/mattermost/mattermost-server/v6
      vulnerable_at: 6.7.2
    - module: github.com/mattermost/mattermost/server/v8
      versions:
        - fixed: 8.0.0-20250402193107-65343f84a783
summary: |-
    Mattermost fails to properly invalidate personal access tokens upon user
    deactivation in github.com/mattermost/mattermost-server
cves:
    - CVE-2025-3230
ghsas:
    - GHSA-mc2f-jgj6-6cp3
references:
    - advisory: https://github.com/advisories/GHSA-mc2f-jgj6-6cp3
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-3230
    - fix: https://github.com/mattermost/mattermost/commit/65343f84a7830fa8078fe3df879fca924e4fac01
    - web: https://mattermost.com/security-updates
notes:
    - fix: 'github.com/mattermost/mattermost/server/v8: could not add vulnerable_at: could not find tagged version between introduced and fixed'
source:
    id: GHSA-mc2f-jgj6-6cp3
    created: 2025-05-30T19:04:42.073063127Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

Labels

triaged

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions