CVE-2025-6227
Invite token is used as part of the secure communication
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Invite token is used as part of the secure communication
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Record
CVE-2025-6227- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
EUVDEUVD-2025-21876
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Record
EUVD-2025-21876- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4fwj-8595-wp25
Mattermost has Insufficiently Protected Credentials
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Record
GHSA-4fwj-8595-wp25- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
NVD
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Record
CVE-2025-6227- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSV
Invite token is used as part of the secure communication
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Record
CVE-2025-6227- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVGHSA-4fwj-8595-wp25
Mattermost has Insufficiently Protected Credentials
Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.
- Record
GHSA-4fwj-8595-wp25- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVGO-2025-3818 No score
Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server
Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server
- Record
GO-2025-3818- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score
govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/mattermost/mattermost-serverGo |
10.5.0 up to 10.5.8 | 10.5.8 |
github.com/mattermost/mattermost-serverGo |
9.11.0 up to 9.11.17 | 9.11.17 |
github.com/mattermost/mattermost/server/v8Go |
before 8.0.0-20250612074655-8f8612c63783 | 8.0.0-20250612074655-8f8612c63783 |
github.com/mattermost/mattermost-serverGo |
9.11.0+incompatible up to 9.11.17+incompatible, 10.5.0+incompatible up to 10.5.8+incompatible | 9.11.17+incompatible10.5.8+incompatible |
github.com/mattermost/mattermost-server/v5Go |
All versions | None known |
github.com/mattermost/mattermost-server/v6Go |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 0.0.20250730T213748-1.1 | 0.0.20250730T213748-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-6227 is a low vulnerability (CVSS 2.2) in Mattermost, published July 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in github.com/mattermost/mattermost-server 10.5.8.
References
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2025-6227
github.com/mattermost/mattermost/commit/fbf105f6ef8f6cd5a89f859f09a2d1216cd81c05
Show 56 moreShow less
suse.com/security/cve/CVE-2024-44905