CVE-2026-16045: Delegated OAuth tokens could revoke unrelated OAuth application authorizations
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.. Mattermost Advisory ID: MMSA-2026-00704
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.7 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.22 - Compensating control
Until upgraded, restrict access to Mattermost OAuth deauthorization and personal access token management endpoints so they are only reachable from the direct user session (e.g., block access from delegated OAuth tokens).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16045?
The severity of CVE-2026-16045 is classified as low with a CVSS score of 2.7.
How do I fix CVE-2026-16045?
To mitigate CVE-2026-16045, upgrade Mattermost to version 11.7.7 or 10.11.22 or later.
What does CVE-2026-16045 affect?
CVE-2026-16045 affects Mattermost versions 11.7.x up to 11.7.6 and 10.11.x up to 10.11.21.
What is the risk associated with CVE-2026-16045?
The risk associated with CVE-2026-16045 includes unauthorized OAuth app revocation of user authorizations.
How can CVE-2026-16045 impact user data?
CVE-2026-16045 can potentially allow OAuth applications to revoke unrelated user authorizations, impacting the functionality of integrations.