Cache Invalidation Flaw in Mattermost Affects User Accounts and Bots

CVE-2025-2475

What is CVE-2025-2475?

In certain versions of Mattermost, a flaw exists within the system's cache invalidation process, specifically affecting scenarios where user accounts are converted into bot accounts. This vulnerability permits an attacker to authenticate to the bot account using valid user credentials, but only once. Consequently, if an attacker successfully exploits this flaw, they can bypass typical authentication barriers, potentially leading to unauthorized actions within the Mattermost environment.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References