Upstream information
Description
Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
CNA (Mattermost) | |
---|---|
Base Score | 4.2 |
Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Attack Vector | Network |
Attack Complexity | High |
Privileges Required | Low |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | Low |
Integrity Impact | Low |
Availability Impact | None |
CVSSv3 Version | 3.1 |
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2025-15225 |
SUSE Timeline for this CVE
CVE page created: Fri May 30 17:06:43 2025CVE page last modified: Fri Jul 4 12:35:43 2025