tocsin

Go/github.com/mattermost/mattermost CVE-2025-13324: low 3.7, EPSS 0.20%

Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost

Action: Upgrade github.com/mattermost/mattermost to 10.11.5+incompatible or later.

go get github.com/mattermost/mattermost@v10.11.5+incompatible
go get github.com/mattermost/mattermost@v10.12.2+incompatible
go get github.com/mattermost/mattermost@v11.0.4+incompatible

Affected

introducedfixedlast affected
10.11.0-rc1+incompatible10.11.5+incompatible-
10.12.0+incompatible10.12.2+incompatible-
11.0.0-alpha.1+incompatible11.0.4+incompatible-

Fixed versions

10.11.5+incompatible10.12.2+incompatible11.0.4+incompatible

Sources

CVE-2025-13324 · published · modified · JSON