CVE-2025-2475
📋 TL;DR
Mattermost fails to invalidate user cache when converting accounts to bots, allowing attackers to log in once using the original user credentials. This affects Mattermost instances running vulnerable versions where user-to-bot conversions occur.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains unauthorized access to a bot account, potentially accessing sensitive channels, data, or performing malicious actions under the bot's identity.
Likely Case
Limited one-time access to a bot account, potentially allowing information gathering or limited unauthorized actions before credentials are invalidated.
If Mitigated
No impact if proper access controls, monitoring, and patching are implemented to prevent exploitation.
🎯 Exploit Status
Requires knowledge of credentials for a user account that was converted to a bot.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.5.2, 10.4.4, 9.11.10 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup Mattermost data. 2. Download patched version from Mattermost releases. 3. Stop Mattermost service. 4. Install updated version. 5. Restart Mattermost service. 6. Verify version update.
🔧 Temporary Workarounds
Disable user-to-bot conversions
allPrevent conversion of user accounts to bot accounts until patched.
# Configure Mattermost to restrict bot creation permissions
Reset bot credentials
allManually reset credentials for any bots created from user accounts.
# Use Mattermost CLI or admin console to reset bot tokens
🧯 If You Can't Patch
- Monitor audit logs for unusual bot login activity
- Implement strict access controls and review bot permissions
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: mattermost versionCheck Version:
mattermost versionVerify Fix Applied:
Confirm version is 10.5.2+, 10.4.4+, or 9.11.10+ and test user-to-bot conversion cache behavior.📡 Detection & Monitoring
Log Indicators:
- Unexpected bot login events
- User-to-bot conversion logs followed by authentication attempts
Network Indicators:
- Unusual authentication patterns to bot accounts
SIEM Query:
source="mattermost" (event="user_converted_to_bot" OR event="login") | stats count by user