5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3230

CVE-2025-3230: Mattermost fails to properly invalidate personal access tokens upon user deactivation

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3230

CVE-2025-3230:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.7.0-rc1, < 10.7.1	10.7.1
github.com/mattermost/mattermost/server/v8	go	>= 10.6.0-rc1, < 10.6.3	10.6.3
github.com/mattermost/mattermost/server/v8	go	>= 10.0.0-rc1, < 10.5.4	10.5.4
github.com/mattermost/mattermost/server/v8	go	>= 9.0.0-rc1, < 9.11.13	9.11.13
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250402193107-65343f84a783	8.0.0-20250402193107-65343f84a783

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-3230) concerns Mattermost's failure to properly invalidate personal access tokens (PATs) upon user deactivation, allowing continued system access for deactivated users. The analysis of the provided commit 65343f84a7830fa8078fe3df879fca924e4fac01 reveals that the core issue lay within the (*app.App).UpdateActive function located in server/channels/app/user.go.

The patch modifies this function by reordering the execution of a.InvalidateCacheForUser(user.Id). Previously, this cache invalidation call was placed after critical deactivation steps (like session revocation). The vulnerability arose because token validation mechanisms likely relied on this cache to check a user's active status. With the delayed invalidation, these mechanisms could read stale data, perceive a deactivated user as still active, and thus validate their PATs.

The fix moves the cache invalidation to occur before the main deactivation logic if the user is being set to inactive (!active). This ensures that any system component checking the user's status via the cache will immediately see the updated (deactivated) status, leading to the correct invalidation or rejection of their PATs.

The E2E test added in the commit (deactivated_user_spec.ts) further supports this by explicitly testing the scenario: creating a PAT, deactivating the user, and then attempting to use the PAT, expecting it to fail. This confirms that the change in (*app.App).UpdateActive rectifies the token validation loophole.

Therefore, (*app.App).UpdateActive is identified as the function containing the flawed logic that led to the vulnerability. While it doesn't directly process malicious input for this specific flaw, its incorrect sequencing of cache invalidation during the user deactivation process created the vulnerable state exploited by continued use of PATs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.