What’s Vulnerable › Vulnerabilities

CVE-2022-1385: Invitation Email is resent as a Reminder after invalidating pending email invites

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-19 · updated 2026-06-17
• Weakness: CWE-664

Description

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.

Affected products

• Mattermost: before 6.5.0 — fixed in 6.5.0

How to fix

Upgrade to a fixed version: Mattermost 6.5.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/1486820
• https://mattermost.com/security-updates/
• https://hackerone.com/reports/1486820
• https://mattermost.com/security-updates/

Get alerted when CVE-2022-1385 or the next vulnerability affects your stack