CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2025-1412

Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 16.7%

CVSS Severity

CVSS v3 Score 3.1

References

https://mattermost.com/security-updates

Products affected by CVE-2025-1412

Mattermost » Mattermost Server » Version: 10.4.0

cpe:2.3:a:mattermost:mattermost_server:10.4.0
Mattermost » Mattermost Server » Version: 10.4.1

cpe:2.3:a:mattermost:mattermost_server:10.4.1
Mattermost » Mattermost Server » Version: 9.11.0

cpe:2.3:a:mattermost:mattermost_server:9.11.0
Mattermost » Mattermost Server » Version: 9.11.1

cpe:2.3:a:mattermost:mattermost_server:9.11.1
Mattermost » Mattermost Server » Version: 9.11.2

cpe:2.3:a:mattermost:mattermost_server:9.11.2
Mattermost » Mattermost Server » Version: 9.11.3

cpe:2.3:a:mattermost:mattermost_server:9.11.3
Mattermost » Mattermost Server » Version: 9.11.4

cpe:2.3:a:mattermost:mattermost_server:9.11.4
Mattermost » Mattermost Server » Version: 9.11.5

cpe:2.3:a:mattermost:mattermost_server:9.11.5
Mattermost » Mattermost Server » Version: 9.11.6

cpe:2.3:a:mattermost:mattermost_server:9.11.6

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2025-1412

Products

Pricing

Contact Us