MEDIUM
Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
Published Jul 13, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.30%
Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680
Affected products
-
- Version 10.11.0StatusaffectedConstraints<=10.11.19
- Version 11.6.0StatusaffectedConstraints<=11.6.4
- Version 11.7.0StatusaffectedConstraints<=11.7.2
- Version 10.11.20StatusunaffectedConstraints-
- Version 11.6.5StatusunaffectedConstraints-
- Version 11.7.3StatusunaffectedConstraints-
- Version 11.8.0StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | Mattermost | unaffected |
|
OR
- ≥ 10.11.0 · < 10.11.20
- ≥ 11.6.0 · < 11.6.5
- ≥ 11.7.0 · < 11.7.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update Mattermost to versions 11.8.0, 11.7.3, 11.6.5, 10.11.20 or higher.
Weaknesses (1)
References (1)
- https://mattermost.com/security-updates vendor-advisoryVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://mattermost.com/security-updates | vendor-advisoryVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Mattermost
Published Jul 13, 2026
Updated Jul 15, 2026
Reserved May 26, 2026
Link CVE-2026-9571
CISA Vulnrichment
Updated Jul 14, 2026