{"id":"EUVD-2025-203920","revision":"e42f62830747423c997af6599577c9b3","records":[{"revision":"e42f62830747423c997af6599577c9b3","observedAt":"2026-11-02T23:59:56.753+00:00","statement":{"source":"euvd","id":"EUVD-2025-203920","aliases":["CVE-2025-13324","GHSA-x3r8-2hmh-89f5"],"title":"Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which a…","description":"Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7,"severity":null}],"references":["https://mattermost.com/security-updates"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203920","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 17, 2025, 6:14:13 PM","dateUpdated":"Dec 24, 2025, 10:16:53 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203920","identifiers":["EUVD-2025-203920","CVE-2025-13324","GHSA-x3r8-2hmh-89f5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}