CVE-2026-9571: Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.3 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch MMSA-2026-00680
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9571?
The severity of CVE-2026-9571 is classified as medium with a score of 6.5.
How do I fix CVE-2026-9571?
To fix CVE-2026-9571, update to Mattermost versions greater than 11.7.2, 11.6.4, or 10.11.19.
What is the risk associated with CVE-2026-9571?
CVE-2026-9571 has a risk score of 27, indicating a notable potential threat.
What impact does CVE-2026-9571 have on affected systems?
CVE-2026-9571 allows deactivated user accounts to continue obtaining valid OAuth access tokens, potentially leading to unauthorized access.
Who is affected by CVE-2026-9571?
CVE-2026-9571 affects users of Mattermost Server versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19.