CVE-2026-9571

Summary

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost11.7.0 <= 11.7.2affected
MattermostMattermost11.6.0 <= 11.6.4affected
MattermostMattermost10.11.0 <= 10.11.19affected
MattermostMattermost11.8.0unaffected
MattermostMattermost11.7.3unaffected
MattermostMattermost11.6.5unaffected
MattermostMattermost10.11.20unaffected

Weaknesses

  • CWE-305: CWE-305 – Authentication Bypass by Primary Weakness

References