Introduction
Attackers can bypass Mattermost team membership restrictions and join any team by manipulating OAuth state during the invitation process. The issue affects organizations that use Mattermost for secure collaboration, especially those that rely on strict team-based access controls.
Mattermost is an open-source collaboration and messaging platform used by enterprises, governments, and critical infrastructure operators. Its focus on security and self-hosting has led to adoption in sectors with strict information protection requirements.
Technical Information
CVE-2025-58073 is a missing authorization check (CWE-862) in Mattermost's team invitation flow when OAuth authentication is used. In affected versions, the platform does not verify that the user accepting a team invitation through an original invite token is the intended recipient. Any authenticated user can therefore manipulate the OAuth state parameter and join any team, regardless of invitation restrictions or team policies.
The vulnerability sits where OAuth authentication flows meet team invitation tokens. During the OAuth handshake, the state parameter is meant to maintain session integrity and prevent CSRF. Mattermost's implementation does not bind the state tightly enough to the invite token and the authenticated user. By tampering with the state parameter, an attacker can craft requests that tie their own session to a valid invite token. That bypasses the team membership controls and gives the attacker unauthorized access to protected teams.
No public code snippets or detailed implementation artifacts are available. Exploitation requires only an authenticated session, with no elevated privileges.
Affected Systems and Versions
- Mattermost 10.11.x up to and including 10.11.1
- Mattermost 10.10.x up to and including 10.10.2
- Mattermost 10.5.x up to and including 10.5.10
All configurations in these versions that use OAuth for authentication and team invitations are vulnerable.
Vendor Security History
Mattermost has fixed earlier vulnerabilities in its OAuth authentication and team invitation logic. The vendor runs a responsible disclosure process, backports security fixes to supported releases, and typically publishes CVE details 30 days after a patch release. Security updates ship monthly, and the vendor has a history of responding to reported issues on time.
