CyberRota Analysis
AI-GeneratedMattermost versions 11.7.x up to 11.7.2, 11.6.x up to 11.6.4, and 10.11.x up to 10.11.19 are vulnerable due to a failure to invalidate OAuth refresh tokens when user accounts are deactivated. This oversight allows deactivated users or attackers with valid refresh tokens to generate new access tokens, potentially leading to unauthorized access to sensitive data. Organizations using these Mattermost versions should prioritize patching to mitigate the risk of account takeover and unauthorized access.
Original NVD Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680
Related CVEs
Other vulnerabilities affecting the same vendor(s)