CVE-2025-41410: Mattermost has a Missing Authorization vulnerability
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.
References
- github.com/advisories/GHSA-3q4q-wqm6-hvf3
- github.com/mattermost/mattermost
- github.com/mattermost/mattermost/commit/01b95392a450676407475596d1c041a047067329
- github.com/mattermost/mattermost/commit/0d6e8fa2e4681a172a136db18001104a57f9c28e
- github.com/mattermost/mattermost/commit/ef896a4ea60cacbe03124106e1f42e5c25276427
- mattermost.com/security-updates
- nvd.nist.gov/vuln/detail/CVE-2025-41410
Code Behaviors & Features
Detect and mitigate CVE-2025-41410 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →