CVE-2025-31947

Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost.

Published: May 15, 2025
Updated: Aug 11, 2025
CVE: CVE-2025-31947
GHSA: GHSA-qgwx-rffp-6cx9
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

CWEs:

CWE-645

Affected Software
References

Software	From	Fixed in
github.com/mattermost/mattermost/server/v8	10.6.0	10.6.2
github.com/mattermost/mattermost/server/v8	10.5.0	10.5.3
github.com/mattermost/mattermost/server/v8	10.4.0	10.4.5
github.com/mattermost/mattermost/server/v8	9.11.0	9.11.12
github.com/mattermost/mattermost/server/v8	-	8.0.0-20250415054241-76ab3867b785

https://github.com/mattermost/mattermost/pull/30821
https://mattermost.com/security-updates

Vulnerability Database

CVE-2025-31947

Deep Security Visibility Without the Complexity