cve.bz

CVE-2025-31947

5.3 mediumEPSS 0.4%

Medium (5.3) in mattermost mattermost server. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/mattermost/mattermost/server/v8 10.4.5, 10.5.3, 10.6.2.

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS
0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE
CWE-645
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qgwx-rffp-6cx9Gogithub.com/mattermost/mattermost/server/v8>=10.6.0 <10.6.210.6.2
GHSA-qgwx-rffp-6cx9Gogithub.com/mattermost/mattermost/server/v8>=10.5.0 <10.5.310.5.3
GHSA-qgwx-rffp-6cx9Gogithub.com/mattermost/mattermost/server/v8>=10.4.0 <10.4.510.4.5
GHSA-qgwx-rffp-6cx9Gogithub.com/mattermost/mattermost/server/v8>=9.11.0 <9.11.129.11.12
GHSA-qgwx-rffp-6cx9Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20250415054241-76ab3867b7858.0.0-20250415054241-76ab3867b785
GO-2025-3692Gogithub.com/mattermost/mattermost-server>=9.11.0+incompatible <9.11.12+incompatible
>=10.4.0+incompatible <10.4.5+incompatible
>=10.5.0+incompatible <10.5.3+incompatible
>=10.6.0+incompatible <10.6.2+incompatible		9.11.12+incompatible, 10.4.5+incompatible, 10.5.3+incompatible, 10.6.2+incompatible
GO-2025-3692Gogithub.com/mattermost/mattermost-server/v5all versionsno fix published
GO-2025-3692Gogithub.com/mattermost/mattermost-server/v6all versionsno fix published
GO-2025-3692Gogithub.com/mattermost/mattermost/server/v8<8.0.0-20250415054241-76ab3867b7858.0.0-20250415054241-76ab3867b785

References

Check your stackJSON