CVE-2025-13821
📋 TL;DR
This vulnerability allows authenticated Mattermost users to exfiltrate sensitive data including password hashes and MFA secrets through WebSocket messages. The flaw occurs when users update their profile nicknames or trigger email verification events. Organizations running affected Mattermost versions are at risk.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain password hashes for offline cracking and MFA secrets, potentially leading to account compromise and lateral movement within the organization.
Likely Case
Malicious insiders or compromised accounts could exfiltrate sensitive user data, leading to credential theft and potential account takeover.
If Mitigated
With proper access controls and monitoring, impact is limited to authenticated users only, but still represents a significant data exposure risk.
🎯 Exploit Status
Exploitation requires authenticated user access but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions 11.1.3, 10.11.10, 11.2.2 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup your Mattermost instance. 2. Upgrade to patched version (11.1.3, 10.11.10, or 11.2.2+). 3. Restart Mattermost service. 4. Verify upgrade completed successfully.
🔧 Temporary Workarounds
Disable WebSocket connections
allTemporarily disable WebSocket functionality to prevent exploitation
Set 'EnableWebSocket' to false in config.json
Restrict user permissions
allLimit profile update permissions to administrators only
Adjust team permissions via System Console > Permissions
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual profile update activity
- Enable detailed logging of WebSocket connections and user profile changes
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About Mattermost or run 'mattermost version' commandCheck Version:
mattermost versionVerify Fix Applied:
Verify version is 11.1.3, 10.11.10, 11.2.2 or later and test profile nickname updates📡 Detection & Monitoring
Log Indicators:
- Unusual frequency of profile nickname updates
- Multiple email verification events from single user
- WebSocket connections with abnormal data patterns
Network Indicators:
- Unusual WebSocket traffic patterns
- Large outbound data transfers during profile updates
SIEM Query:
source="mattermost" AND (event="user_updated" OR event="email_verification") AND user!="system" | stats count by user