OAuth Token Persistence in Mattermost After Account Deactivation

Executive Summary

This vulnerability affects certain versions of Mattermost (11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19) where OAuth refresh tokens are not invalidated when a user account is deactivated.

Because the refresh tokens remain valid, a deactivated user or an attacker who has a valid refresh token can use it to obtain new access tokens through the OAuth refresh token grant endpoint.

Useful 0 Not Useful 0

Detection Guidance

Detecting CVE-2026-9571 on your network or system involves checking for active OAuth refresh tokens associated with deactivated user accounts in Mattermost. Since the vulnerability allows a deactivated user or an attacker with a valid refresh token to obtain new access tokens, you should verify whether refresh tokens are properly invalidated upon account deactivation.

• Check Mattermost server logs for OAuth refresh token grant requests from deactivated users. Look for entries in the logs that show successful token refreshes after account deactivation.
• Use Mattermost's API to query active refresh tokens. You can send a GET request to the /api/v4/oauth/tokens endpoint (if accessible) to list active tokens and cross-reference them with deactivated user accounts.
• Verify the Mattermost server version. If your instance is running a vulnerable version (11.7.x <= 11.7.2, 11.6.x <= 11.6.4, or 10.11.x <= 10.11.19), it is likely affected by this vulnerability.
• Monitor network traffic for unusual OAuth token refresh requests. Tools like Wireshark or network firewalls can help detect repeated or unexpected token refresh attempts.

No specific commands are provided in the context, but you can use standard log analysis tools (e.g., grep, awk) to search for relevant log entries. For example:

• grep 'oauth/token' /var/log/mattermost/mattermost.log | grep 'refresh_token'
• If you have access to the Mattermost database, query the OAuthAccessData table to check for active refresh tokens linked to deactivated users.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthorized access to the system by enabling a deactivated user or an attacker with a valid refresh token to continue obtaining new access tokens.

This can lead to unauthorized access to sensitive information and potentially compromise the confidentiality and integrity of the affected Mattermost environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with standards and regulations like GDPR and HIPAA due to its implications on data access control and security.

• GDPR: The vulnerability allows unauthorized access to user data via valid refresh tokens even after account deactivation. This violates GDPR's requirements for data protection, access control, and the right to erasure (Article 17), as deactivated users or attackers may still access personal data.
• HIPAA: For organizations handling protected health information (PHI), this vulnerability could lead to unauthorized access to sensitive patient data. HIPAA requires strict access controls and audit trails, which this flaw undermines by allowing continued access post-deactivation.

Failure to address this issue may result in non-compliance penalties, as both GDPR and HIPAA mandate timely remediation of vulnerabilities that could expose sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Mattermost to a version later than 11.7.2, 11.6.4, or 10.11.19, depending on your current version series, as these versions fail to invalidate OAuth refresh tokens upon user account deactivation.

Additionally, monitor Mattermost security updates and advisories to stay informed about patches and fixes.

Useful 0 Not Useful 0