← CVE Intelligence

CVE-2025-41410

Slack import bypasses email verification for team access controls PUBLISHED

Description (CNA)

Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected 10.10.0 through 10.10.2; affected 10.5.0 through 10.5.10; affected 10.11.0 through 10.11.2; unaffected 10.12.0; unaffected 10.10.3; unaffected 10.5.11; unaffected 10.11.3

CWE

CWE-862

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.