CVE-2025-1412 — Session Persistence After User-to-Bot Conversion

CVE-2025-1412

Session Persistence After User-to-Bot Conversion PUBLISHED

Description (CNA)

Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 9.11.0 through 9.11.6; affected 10.4.0 through 10.4.1; unaffected 10.5.0; unaffected 9.11.7; unaffected 10.4.2

CWE

CWE-384

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.