Session Hijacking in Mattermost via Magic-Link Token

Executive Summary

This vulnerability exists in Mattermost versions 11.7.x up to 11.7.2 and 11.6.x up to 11.6.4. It occurs because the system fails to verify whether a guest account has been deactivated before creating a session through the magic-link token login method. As a result, a guest user who has been deactivated can still obtain a fully functional session if they use a magic-link token that was issued before their account was deactivated.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if deactivated guest accounts in Mattermost can still use magic-link tokens to obtain active sessions. Since the issue involves session creation via magic-link tokens for deactivated guest users, you can perform the following steps:

• Review Mattermost server logs for session creation events tied to guest accounts marked as deactivated. Look for entries where a magic-link token is used to authenticate a guest user whose account status is 'deactivated'.
• Use Mattermost's API or database queries to identify active sessions associated with deactivated guest accounts. For example, query the 'Sessions' table in the Mattermost database for sessions linked to deactivated users.
• Test the vulnerability manually by deactivating a guest account, then attempting to log in using a magic-link token issued before deactivation. If the login succeeds, the system is vulnerable.

No specific commands are provided in the context, but you can use Mattermost's CLI or database tools (e.g., PostgreSQL or MySQL queries) to inspect user statuses and active sessions. For example:

• Check user status in the database: SELECT * FROM Users WHERE Roles LIKE '%guest%' AND DeleteAt != 0; (This queries deactivated guest accounts.)
• Check active sessions: SELECT * FROM Sessions WHERE UserId IN (SELECT Id FROM Users WHERE Roles LIKE '%guest%' AND DeleteAt != 0);

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that a deactivated guest user can regain access to the system by using a previously issued magic-link token. This could allow unauthorized access to resources or information that should no longer be accessible to that user, potentially leading to information disclosure or unauthorized actions within the Mattermost environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with standards and regulations like GDPR and HIPAA due to its potential to allow unauthorized access to user sessions. Specifically, the issue permits a deactivated guest user to retain access via a previously issued magic-link token, which could lead to unauthorized data exposure or manipulation.

• GDPR: The vulnerability could result in a breach of personal data if a deactivated guest user accesses sensitive information, violating GDPR's requirements for data protection and access control (Articles 5, 25, and 32).
• HIPAA: If the affected system handles protected health information (PHI), unauthorized access by a deactivated user could constitute a breach under the HIPAA Security Rule, which mandates strict access controls and audit measures (45 CFR Part 164, Subpart C).

Organizations using Mattermost in regulated environments should assess the risk of non-compliance and apply the recommended patches or mitigations to avoid potential violations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Mattermost to the latest patched version. According to the CVE description, the issue affects versions 11.7.x <= 11.7.2 and 11.6.x <= 11.6.4. Apply the fix released in the security update referenced in the Mattermost advisory (MMSA-2026-00681).
• If upgrading is not immediately possible, disable magic-link authentication for guest accounts as a temporary workaround. This prevents deactivated guest users from exploiting the vulnerability.
• Review and invalidate all active sessions for guest accounts, especially those marked as deactivated. This can be done via the Mattermost admin console or by using database queries to delete sessions tied to deactivated users.
• Monitor Mattermost logs for any suspicious session creation events involving guest accounts. Set up alerts for repeated authentication attempts from deactivated accounts.
• Subscribe to Mattermost security bulletins to receive notifications about future updates and patches. This ensures timely application of fixes for similar vulnerabilities.

Useful 0 Not Useful 0