Cache Invalidation Flaw in Mattermost Affects User Accounts and Bots

CVE-2025-2475

What is CVE-2025-2475?

In certain versions of Mattermost, a flaw exists within the system's cache invalidation process, specifically affecting scenarios where user accounts are converted into bot accounts. This vulnerability permits an attacker to authenticate to the bot account using valid user credentials, but only once. Consequently, if an attacker successfully exploits this flaw, they can bypass typical authentication barriers, potentially leading to unauthorized actions within the Mattermost environment.

References