CVE-2025-2571
📋 TL;DR
Mattermost fails to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via Google OAuth signup flow. This affects Mattermost instances with Google OAuth enabled where user-to-bot conversions occur.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent access to bot accounts with elevated privileges, potentially accessing sensitive channels, data, or performing unauthorized actions.
Likely Case
Unauthorized access to specific bot accounts leading to data exposure or limited privilege escalation within the Mattermost instance.
If Mitigated
Minimal impact if Google OAuth is disabled or user-to-bot conversions are restricted to trusted administrators.
🎯 Exploit Status
Exploitation requires knowledge of the conversion process and access to Google OAuth flow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.7.1, 10.6.3, 10.5.4, 9.11.13
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: Yes
Instructions:
1. Backup Mattermost configuration and database. 2. Download patched version from Mattermost releases. 3. Stop Mattermost service. 4. Install patched version. 5. Restart Mattermost service. 6. Verify version update.
🔧 Temporary Workarounds
Disable Google OAuth
allTemporarily disable Google OAuth authentication to prevent exploitation.
Edit config.json: set 'GoogleSettings.Enable' to false
Restart Mattermost service
Restrict User-to-Bot Conversions
allLimit account conversions to trusted administrators only.
Configure Mattermost permissions to restrict 'Convert User to Bot' to system admins
🧯 If You Can't Patch
- Monitor audit logs for unusual bot account activity or unauthorized access attempts.
- Review and revoke unnecessary bot account permissions, especially those converted from user accounts.
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via web interface or command line, verify if within affected ranges and Google OAuth is enabled.Check Version:
mattermost versionVerify Fix Applied:
Confirm version is updated to patched release and test user-to-bot conversion with Google OAuth.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts via Google OAuth for bot accounts
- Multiple failed conversion attempts
Network Indicators:
- Unexpected OAuth callback requests to bot endpoints
SIEM Query:
source="mattermost" AND (event="oauth_authentication" AND account_type="bot")