GitHub Advisoryadvisory · Go

GHSA-hqpj-f3jh-29vx Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation

LOW Published 2026-05-18 Modified 2026-06-01 Official page ↗
Aliases
CVE-2026-4273
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-06-01

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 11.5.0, < 11.5.2 → fixed in 11.5.2 • Go github.com/mattermost/mattermost/server/v8: >= 10.11.0, < 10.11.14 → fixed in 10.11.14 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20260313190740-742e0be95074 → fixed in 8.0.0-20260313190740-742e0be95074 • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20260313190740-742e0be95074 → fixed in 5.3.2-0.20260313190740-742e0be95074

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

Related

Alias · CVE (1)

  • CVE-2026-4273 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References