Vulnerability Details CVE-2025-2571
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 7.8%
CVSS Severity
CVSS v3 Score 4.2
References
Products affected by CVE-2025-2571
-
cpe:2.3:a:mattermost:mattermost_server:10.5.0
-
cpe:2.3:a:mattermost:mattermost_server:10.5.1
-
cpe:2.3:a:mattermost:mattermost_server:10.5.2
-
cpe:2.3:a:mattermost:mattermost_server:10.5.3
-
cpe:2.3:a:mattermost:mattermost_server:10.6.0
-
cpe:2.3:a:mattermost:mattermost_server:10.6.1
-
cpe:2.3:a:mattermost:mattermost_server:10.6.2
-
cpe:2.3:a:mattermost:mattermost_server:10.7.0
-
cpe:2.3:a:mattermost:mattermost_server:9.11.0
-
cpe:2.3:a:mattermost:mattermost_server:9.11.1
-
cpe:2.3:a:mattermost:mattermost_server:9.11.10
-
cpe:2.3:a:mattermost:mattermost_server:9.11.11
-
cpe:2.3:a:mattermost:mattermost_server:9.11.12
-
cpe:2.3:a:mattermost:mattermost_server:9.11.2
-
cpe:2.3:a:mattermost:mattermost_server:9.11.3
-
cpe:2.3:a:mattermost:mattermost_server:9.11.4
-
cpe:2.3:a:mattermost:mattermost_server:9.11.5
-
cpe:2.3:a:mattermost:mattermost_server:9.11.6
-
cpe:2.3:a:mattermost:mattermost_server:9.11.7
-
cpe:2.3:a:mattermost:mattermost_server:9.11.8
-
cpe:2.3:a:mattermost:mattermost_server:9.11.9