CVE-2026-4273

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4273
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4273.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4273
Aliases
Published
2026-05-18T06:56:11.868Z
Modified
2026-07-08T08:13:26.626475252Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Insufficient token rotation validation in remote cluster invite confirmation
Details

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "11.5.0"
                },
                {
                    "last_affected": "11.5.1"
                },
                {
                    "introduced": "10.11.0"
                },
                {
                    "last_affected": "10.11.13"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4273.json",
    "cna_assigner": "Mattermost",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Introduced
5b955468ea1ea8b56c0fb10feb258a36a767d7bb
Fixed
b21ef302025ee100f04f358c16301dc75fea91d9
Introduced
9f2616376582893035a7e3cb38b0fab648bba4e8
Fixed
cc4ef6863ee114bc96be4e34478ec2f0db3eac4e
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "10.11.0"
        },
        {
            "fixed": "10.11.14"
        },
        {
            "introduced": "11.5.0"
        },
        {
            "fixed": "11.5.2"
        }
    ]
}

Affected versions

@mattermost/client@10.*
@mattermost/client@10.11.0
@mattermost/types@10.*
@mattermost/types@10.11.0
mattermost-redux@10.*
mattermost-redux@10.11.0
v10.*
v10.11.0
v10.11.0-rc3
v10.11.1
v10.11.1-rc1
v10.11.10
v10.11.11
v10.11.11-rc1
v10.11.11-rc2
v10.11.12
v10.11.13
v10.11.13-rc1
v10.11.14-rc1
v10.11.2
v10.11.2-rc1
v10.11.2-rc2
v10.11.3
v10.11.4
v10.11.4-rc1
v10.11.4-rc2
v10.11.4-rc3
v10.11.5
v10.11.6
v10.11.7
v10.11.8
v10.11.9
v10.11.9-rc1
v11.*
v11.5.0
v11.5.1
v11.5.2-rc1
v11.5.2-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4273.json"