CVE-2026-9571CWE-305

Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost

Medium · published July 13, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2026-07-13T07:50Z
EPSS history
Timeline
  • 13 JUL 07:50Z
    Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
    cvelistv5