CVE-2025-3230: Mattermost fails to properly invalidate personal access tokens upon user deactivation

May 30, 2025

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

References

github.com/advisories/GHSA-mc2f-jgj6-6cp3
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/65343f84a7830fa8078fe3df879fca924e4fac01
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-3230

Code Behaviors & Features

Detect and mitigate CVE-2025-3230 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →