CVE-2025-58075: Mattermost Server Auth Bypass Vulnerability

CVE-2025-58075 Overview

CVE-2025-58075 is a missing authorization vulnerability [CWE-862] in Mattermost Server. The flaw allows an authenticated user to join any team on a Mattermost server by manipulating the SAML RelayState parameter during the invite flow. The server fails to verify that the original invite token authorizes the user to join the target team. Affected releases include Mattermost 10.11.x through 10.11.1, 10.10.x through 10.10.2, and 10.5.x through 10.5.10.

Critical Impact
An authenticated attacker can bypass team membership restrictions and gain access to confidential channels, conversations, and files in any team on a vulnerable Mattermost server.

Affected Products

Mattermost Server 10.11.x <= 10.11.1
Mattermost Server 10.10.x <= 10.10.2
Mattermost Server 10.5.x <= 10.5.10

Discovery Timeline

2025-10-16 - CVE-2025-58075 published to the National Vulnerability Database
2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-58075

Vulnerability Analysis

The vulnerability resides in the team invite verification flow when Mattermost is configured with SAML single sign-on. During authentication, the application carries an invite token using the SAML RelayState parameter. After the identity provider returns the user, the server adds the authenticated user to the team referenced in RelayState without re-validating the invite token against that team.

This flaw is classified as Missing Authorization [CWE-862]. The server treats successful authentication as sufficient evidence to grant team membership. Authorization checks that confirm the invite token belongs to the requested team are absent from the join code path.

The EPSS score is 0.049% with a percentile of 15.659, indicating low observed exploitation activity at this time. There are no public proof-of-concept exploits, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper trust placed in the RelayState value returned by the client through the SAML round trip. The original invite token bound to a specific team is not re-checked against the team identifier the user attempts to join. An attacker can substitute any team ID and the server processes the request as authorized.

Attack Vector

The attack is network-based and requires only low-privilege authenticated access to the Mattermost server. The attacker initiates a legitimate invite flow, intercepts or constructs the SAML request, and modifies the RelayState to reference a target team they are not invited to. After SAML authentication completes, the server adds the attacker to the chosen team, granting access to its channels and data. The vulnerability does not impact availability but enables high confidentiality and integrity impact.

No verified public exploit code is available. Refer to the Mattermost Security Updates advisory for vendor technical details.

Detection Methods for CVE-2025-58075

Indicators of Compromise

Audit log entries showing users added to teams without corresponding invite records or matching invite tokens
SAML authentication events where the RelayState value references team IDs that differ from the originating invite
Unexpected TeamMember records appearing in the database for users who never received an invitation
Access to private channels by users whose team membership was recently established through SAML flows

Detection Strategies

Correlate Mattermost audit logs for user.added_to_team events with the invite issuance log to verify each membership is backed by a valid token for the same team
Monitor SAML SSO callbacks for anomalous RelayState values, including base64-encoded payloads that decode to unexpected team identifiers
Alert on rapid team-join activity from a single user account that targets multiple teams in a short window

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized SIEM and retain at least 90 days for retrospective analysis
Review team membership changes daily, focusing on teams that contain sensitive channels or restricted content
Track HTTP requests to /api/v4/teams/*/members and SAML ACS endpoints for anomalous patterns tied to invite flows

How to Mitigate CVE-2025-58075

Immediate Actions Required

Upgrade Mattermost Server to version 10.11.2, 10.10.3, 10.5.11, or later as published by the vendor
Audit all team memberships established since deploying the affected versions and remove any that lack a corresponding valid invite
Rotate active invite tokens and revoke long-lived invitations until upgrades are complete
Review access logs for confidential teams and verify membership against authorized rosters

Patch Information

Mattermost has released fixed versions addressing CVE-2025-58075. Administrators should consult the Mattermost Security Updates page for the specific patched release matching their deployment branch and apply the upgrade following the vendor's standard procedure.

Workarounds

Temporarily disable SAML-based team invitations and require administrators to add users to teams manually until patches are applied
Restrict team creation and limit which users may issue team invites to reduce the attack surface
Place sensitive teams under additional access review and consider isolating them on a separate Mattermost instance until remediation completes

bash

# Verify the installed Mattermost Server version
mattermost version

# Example upgrade path on Linux (adjust paths and version to your environment)
sudo systemctl stop mattermost
sudo tar -xvzf mattermost-<patched-version>-linux-amd64.tar.gz -C /opt/
sudo systemctl start mattermost