GHSA-qgwx-rffp-6cx9

ghsaUSosv

Mattermost Fails to Lockout LDAP Users After Repeated Login Failures

view advisory published 2025-05-15Licence: CC-BY-4.0

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-31947US	medium5.3	0.35% (29th)	—	2025-05-15
Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://github.com/mattermost/mattermost/pull/30821WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-31947ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan