Overview
A critical vulnerability, identified as CVE-2025-12421, has been discovered in Mattermost. This flaw allows an authenticated user to potentially take over another user’s account. The vulnerability affects Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, and 10.5.x <= 10.5.12. Immediate patching is strongly recommended to mitigate the risk.
Technical Details
The vulnerability stems from a failure to properly verify that the token used during the code exchange process originates from the same authentication flow. This occurs when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. An attacker can exploit this by crafting a specific email address and manipulating the authentication transfer process.
Important Prerequisites:
ExperimentalEnableAuthenticationTransfermust be enabled (default: enabled).RequireEmailVerificationmust be disabled (default: disabled).
The combination of these conditions allows a malicious user to bypass the intended security mechanisms and gain unauthorized access to another user’s account.
CVSS Analysis
- CVE ID: CVE-2025-12421
- Severity: CRITICAL
- CVSS Score: 9.9
A CVSS score of 9.9 indicates the highest level of severity. This vulnerability is easily exploitable and can result in complete compromise of the affected Mattermost instance, including access to sensitive data and control over user accounts.
Possible Impact
Successful exploitation of CVE-2025-12421 can have severe consequences:
- Account Takeover: Attackers can gain complete control of user accounts, including administrator accounts.
- Data Breach: Sensitive data stored within Mattermost can be accessed and potentially exfiltrated.
- Reputation Damage: A successful attack can severely damage an organization’s reputation and trust.
- Business Disruption: Compromised accounts can be used to disrupt communication and collaboration within the organization.
Mitigation and Patch Steps
The primary mitigation is to upgrade to a patched version of Mattermost. Refer to the Mattermost security update for specific version details.
- Upgrade Mattermost: Update your Mattermost server to the latest patched version available. Consult the Mattermost documentation for upgrade instructions.
- Review Configuration: If feasible and after careful consideration of its impact on your organization, consider enabling the
RequireEmailVerificationsetting, if it is disabled. Please evaluate the implications and user impact before making configuration changes.
