Session Privilege Escalation in Mattermost by Mattermost, Inc.

CVE-2025-1412

Summary

Mattermost versions 9.11.x (up to 9.11.6) and 10.4.x (up to 10.4.1) contain a vulnerability that fails to invalidate all active sessions when a user is converted to a bot. This oversight allows the converted user to potentially escalate their privileges based on the permissions assigned to the bot, leading to unauthorized actions within the Mattermost system. It is crucial for users to apply necessary updates and follow security guidelines to mitigate this risk.

References