Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation
GHSA-hqpj-f3jh-29vx · CVE-2026-4273 · GO-2026-5432
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575
Ready to move
Start Securing
Free, no credit card | First findings in minutes