CVE-2026-4273
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575
- CVSS 3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mattermost:mattermost_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hqpj-f3jh-29vx | Go | github.com/mattermost/mattermost/server/v8 | >=11.5.0 <11.5.2 | 11.5.2 |
| GHSA-hqpj-f3jh-29vx | Go | github.com/mattermost/mattermost/server/v8 | >=10.11.0 <10.11.14 | 10.11.14 |
| GHSA-hqpj-f3jh-29vx | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20260313190740-742e0be95074 | 8.0.0-20260313190740-742e0be95074 |
| GHSA-hqpj-f3jh-29vx | Go | github.com/mattermost/mattermost-server | <5.3.2-0.20260313190740-742e0be95074 | 5.3.2-0.20260313190740-742e0be95074 |
| GO-2026-5432 | Go | github.com/mattermost/mattermost-server | >=10.11.0+incompatible <10.11.14+incompatible >=11.5.0+incompatible <11.5.2+incompatible | 10.11.14+incompatible, 11.5.2+incompatible |
| GO-2026-5432 | Go | github.com/mattermost/mattermost-server/v5 | all versions | no fix published |
| GO-2026-5432 | Go | github.com/mattermost/mattermost-server/v6 | all versions | no fix published |
| GO-2026-5432 | Go | github.com/mattermost/mattermost/server/v8 | <8.0.0-20260313190740-742e0be95074 | 8.0.0-20260313190740-742e0be95074 |