CVE-2026-4273

Insufficient token rotation validation in remote cluster invite confirmation

State: Published
Severity: 3.7 Low
Published: May 18, 2026
Updated: May 18, 2026
Reserved: Mar 16, 2026

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

Scores

CVSS	Score	Vector	Source
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	Mattermost

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
MattermostMattermost	11.5.0 through 11.5.1Affected 10.11.0 through 10.11.13Affected 11.6.0Not affected 11.5.2Not affected 10.11.14Not affected

References

MMSA-2026-00575vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.