5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41410

CVE-2025-41410: Mattermost has a Missing Authorization vulnerability

Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41410

CVE-2025-41410:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20250822083415-01b95392a450	8.0.0-20250822083415-01b95392a450
github.com/mattermost/mattermost-server	go	>= 10.10.0, < 10.10.3	10.10.3
github.com/mattermost/mattermost-server	go	>= 10.5.0, < 10.5.11	10.5.11
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.3	10.11.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Slack import feature of Mattermost, where email addresses of imported users were automatically verified without proper authorization checks. This could be exploited by a low-privileged user to bypass domain-based restrictions for team membership.

The analysis of the provided patches points to two key functions:

github.com/mattermost/mattermost/server/platform/services/slackimport.SlackImporter.oldImportUser: This is the core vulnerable function. The diff clearly shows the removal of an unconditional call to VerifyEmail and the introduction of a conditional check based on whether the import is performed by an admin (isAdminImport). Before the patch, any user could trigger this function through a Slack import and have an email from a restricted domain be marked as verified.
github.com/mattermost/mattermost/server/channels/app.App.SlackImport: This function serves as the entry point for the Slack import functionality. The patch modifies this function to check the session of the user initiating the import to determine if they are a system admin. This check is crucial for the fix, as it provides the isAdminImport flag needed by oldImportUser. An exploit would necessarily involve this function to start the import process.

Therefore, a runtime profile of an exploit would show app.App.SlackImport being called, which in turn would lead to the execution of slackimport.SlackImporter.oldImportUser, where the unauthorized email verification would occur in vulnerable versions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.