CVE-2026-4273 — Insufficient token rotation validation in remote cluster invite confirmation

CVE-2026-4273

Insufficient token rotation validation in remote cluster invite confirmation PUBLISHED

Description (CNA)

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 11.5.0 through 11.5.1; affected 10.11.0 through 10.11.13; unaffected 11.6.0; unaffected 11.5.2; unaffected 10.11.14

CWE

CWE-863

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.