CVE-2025-1412: 
Wolfi vulnerability analysis and mitigation

Mattermost versions 9.11.x <= 9.11.6 and 10.4.x <= 10.4.1 contain a security vulnerability where the system fails to invalidate all active sessions when converting a user to a bot (AttackerKB).

The vulnerability stems from a session management flaw where active user sessions remain valid after the user account is converted to a bot. This allows the converted user to maintain their active sessions and potentially escalate their privileges based on the permissions granted to the bot (AttackerKB).

The vulnerability enables converted users to potentially escalate their privileges depending on the permissions granted to the bot account, potentially leading to unauthorized access and privilege escalation (AttackerKB).

The vulnerability requires an attacker to have their user account converted to a bot while maintaining active sessions. The exact conditions and complexity of exploitation are not fully detailed in the available sources (AttackerKB).

Organizations should upgrade to versions newer than Mattermost 9.11.6 for the 9.11.x series or versions newer than 10.4.1 for the 10.4.x series (AttackerKB, Mattermost Security).