CVE-2026-4273
Authentication Bypass in Mattermost via Token Reuse
Publication date: 2026-05-18
Last updated on: 2026-05-19
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.14 (exc) |
| mattermost | mattermost_server | From 11.5.0 (inc) to 11.5.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Mattermost versions 11.5.x up to 11.5.1 and 10.11.x up to 10.11.13. The issue is that the software fails to verify that the RefreshedToken is different from the original invite token during the confirmation of a remote cluster invite.
Because of this failure, an authenticated attacker can bypass the intended token rotation mechanism by sending a specially crafted invite confirmation where the RefreshedToken matches the original token, allowing reuse of the original invite token.
How can this vulnerability impact me? :
This vulnerability allows an authenticated attacker to reuse an original invite token instead of a refreshed one, effectively bypassing token rotation protections.
This could lead to unauthorized access or actions within the Mattermost system related to remote cluster invites, potentially compromising the integrity of invite processes.
However, the CVSS base score is 3.7, indicating a low severity impact with no direct confidentiality or availability impact, but with a low impact on integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Mattermost to a version later than 11.5.1 for the 11.5.x branch or later than 10.11.13 for the 10.11.x branch, as these versions fix the issue with token validation during remote cluster invite confirmation.
Additionally, stay informed about security updates by subscribing to Mattermost's Security Bulletin and regularly checking their security updates page.