Introduction
Attackers can join any team on a vulnerable Mattermost server by manipulating a single parameter in the authentication flow. That gives them unauthorized access to sensitive collaboration spaces regardless of configured team restrictions, in environments that often handle regulated or classified data.
Mattermost is an open-source and commercial collaboration platform used by enterprises, government agencies, and organizations with strict data residency and compliance requirements. It is deployed in defense, critical infrastructure, and regulated industries, so its security directly affects the operational security of thousands of organizations worldwide.
Technical Information
CVE-2025-58075 is an authorization bypass vulnerability in Mattermost versions 10.11.x through 10.11.1, 10.10.x through 10.10.2, and 10.5.x through 10.5.10. The flaw is in the team invitation mechanism, and it appears when a user attempts to join a team using an original invite token.
The root cause is a missing authorization check. When Mattermost processes a join request that includes a valid invite token, it does not confirm that the user is permitted to join the team the request references. SAML authentication flows use the RelayState parameter to maintain state and redirect users after authentication. An attacker who manipulates RelayState can redirect the join process to a different team from the one the invite token is associated with.
Because the system never validates that the user is authorized for the target team, the attacker can join any team on the server, and every configured restriction is bypassed. The vulnerability is classified under CWE-862 (Missing Authorization).
Affected Systems and Versions
- Mattermost 10.11.x up to and including 10.11.1
- Mattermost 10.10.x up to and including 10.10.2
- Mattermost 10.5.x up to and including 10.5.10
In these versions, every configuration that uses invite tokens for team membership is vulnerable.
Vendor Security History
Mattermost has fixed similar authorization and authentication issues before, including:
- CVE-2025-6227: Insufficient token negotiation in invite acceptance
- CVE-2025-3913: Improper validation of team privacy settings
- CVE-2025-3611: Access control issues for System Manager roles
Mattermost follows a monthly patch cycle, runs a responsible disclosure process, and publishes advisories on its security updates page. The repeated team and channel access control flaws indicate that Mattermost's authorization logic remains complex.
