Executive brief
Mattermost, a collaboration platform for secure communication, contains a flaw where user accounts are not fully disconnected after being deactivated. If an administrator deactivates a user, that user (or someone who has stolen their login tokens) can still generate new sessions to access the platform. This could allow unauthorized access to sensitive corporate communications and data even after an employee has been offboarded or their account suspended.
Technical details
A vulnerability in the OAuth implementation of Mattermost Server allows deactivated users to maintain access to the system. The root cause is a failure to invalidate OAuth refresh tokens when a user account is set to a deactivated state. An attacker in possession of a valid refresh token can interact with the OAuth refresh token grant endpoint to obtain new, functional access tokens. This bypasses the intended security control of account deactivation. The issue is resolved in versions 11.8.0, 11.7.3, 11.6.5, and 10.11.20.
Affected products
- Mattermost Mattermost Server 11.7.0 - 11.7.2, 11.6.0 - 11.6.4, 10.11.0 - 10.11.19
Timeline
- 2026-07-13: advisory: MMSA-2026-00680 published by Mattermost
- 2026-07-13: disclosed: CVE-2026-9571 published to NVD