Volerion logoVolerion
Volerion logoVolerion

Mattermost Token Negotiation Vulnerability Allowing Synchronization Payloads via REST API

Vulnerability

A vulnerability exists in Mattermost versions 10.5.x through 10.5.7 and 9.11.x through 9.11.16, where the application fails to properly negotiate a new token when a user accepts an invite. This flaw allows an individual who intercepts both the invite and password to send synchronization payloads to the original server via the REST API.

Impact

Exploitation of this vulnerability could lead to unauthorized synchronization payloads being sent to the server, potentially causing unintended actions or data modifications.

Remediation

Users can upgrade to Mattermost versions 10.9.0 or 10.8.0 to address this vulnerability.

Added: Jul 18, 2025, 12:17 PM
Updated: Jul 18, 2025, 12:17 PM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
0.6
exploitability
6.2
remediation
7.7
relevance
0.3
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.