GHSA-qgwx-rffp-6cx9MediumCVSS 5.8

Mattermost Fails to Lockout LDAP Users After Repeated Login Failures

Published
May 15, 2025
Last Modified
May 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-31947 →

📋 Description

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

🎯 Affected products5

  • go/github.com/mattermost/mattermost/server/v8:>= 10.6.0, <= 10.6.1
  • go/github.com/mattermost/mattermost/server/v8:>= 10.5.0, <= 10.5.2
  • go/github.com/mattermost/mattermost/server/v8:>= 10.4.0, <= 10.4.4
  • go/github.com/mattermost/mattermost/server/v8:>= 9.11.0, <= 9.11.11
  • go/github.com/mattermost/mattermost/server/v8:< 8.0.0-20250415054241-76ab3867b785

🔗 References (4)