CVE-2025-31947

Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

Reserved 2025-04-08 | Published 2025-05-15 | Updated 2025-05-15 | Assigner Mattermost

Problem types

CWE-645: Overly Restrictive Account Lockout Mechanism

Product status

Default status
unaffected

10.6.0
affected

10.5.0
affected

10.4.0
affected

9.11.0
affected

10.7.0
unaffected

10.6.2
unaffected

10.5.3
unaffected

10.4.5
unaffected

9.11.12
unaffected

Credits

John Landells finder

References

mattermost.com/security-updates

cve.org (CVE-2025-31947)

nvd.nist.gov (CVE-2025-31947)

Download JSON