Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, and 9.11.x <= 9.11.11 fail to lock out LDAP users after repeated login failures. This vulnerability allows attackers to lock external LDAP accounts through repeated login attempts via Mattermost.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.8 | CVE-2025-31947 |
Exploitation
To exploit this vulnerability, an attacker can repeatedly attempt to log in to an external LDAP account through the Mattermost platform. By failing to authenticate multiple times, the attacker can lock the account, preventing legitimate users from accessing their accounts.
Affected Products
- Version 10.6.x (up to 10.6.1): Vulnerable to LDAP account lockout issues.
- Version 10.5.x (up to 10.5.2): Susceptible to repeated login failure attacks.
- Version 10.4.x (up to 10.4.4): Affected by the inability to lockout LDAP users.
- Version 9.11.x (up to 9.11.11): Exposed to account lockout vulnerabilities.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Mattermost that address the LDAP lockout issue. Additionally, implementing account lockout policies and monitoring login attempts can help reduce the risk of exploitation.