tocsin

Go/github.com/mattermost/mattermost-server CVE-2025-3230: medium 5.4, EPSS 0.23%

Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 9.11.13+incompatible or later.

go get github.com/mattermost/mattermost-server@v9.11.13+incompatible
go get github.com/mattermost/mattermost-server@v10.5.4+incompatible
go get github.com/mattermost/mattermost-server@v10.6.3+incompatible
go get github.com/mattermost/mattermost-server@v10.7.1+incompatible

Affected

introducedfixedlast affected
9.0.0-rc1+incompatible9.11.13+incompatible-
10.0.0-rc1+incompatible10.5.4+incompatible-
10.6.0-rc1+incompatible10.6.3+incompatible-
10.7.0-rc1+incompatible10.7.1+incompatible-

Fixed versions

9.11.13+incompatible10.5.4+incompatible10.6.3+incompatible10.7.1+incompatible

Sources

CVE-2025-3230 · published · modified · JSON