What is the CVSS score of CVE-2026-3590?

CVE-2026-3590 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3590?

Yes, a patch is available for CVE-2026-3590. Update the affected software to the latest version immediately.

Mattermost CVE-2026-3590

Q: Which versions of Mattermost are affected by CVE-2026-3590?

Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to enforce atomic consumption of guest magic link tokens, allowing unauthenticated…. A patch is available.

EUVD-2026-22915 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-04-15 Mattermost

GHSA-mh4x-rmrx-3hp4

Information Disclosure Mattermost

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 11:41 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 11:30 euvd

EUVD-2026-22915

Analysis Generated

Apr 15, 2026 - 11:30 vuln.today

CVE Published

Apr 15, 2026 - 11:00 nvd

MEDIUM 6.5

DescriptionCVE.org

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests.. Mattermost Advisory ID: MMSA-2026-00624

AnalysisAI

Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to enforce atomic consumption of guest magic link tokens, allowing unauthenticated attackers to establish multiple concurrent authenticated sessions from a single valid magic link. This enables unauthorized access and potential information disclosure without requiring additional credentials or user interaction beyond intercepting or obtaining the link.

Technical ContextAI

Mattermost's guest magic link authentication mechanism is designed to generate single-use tokens for frictionless guest access. The vulnerability stems from a race condition (CWE-367: Time-of-check Time-of-use) in the token validation logic, where the server fails to atomically mark tokens as consumed before processing authentication requests. When concurrent requests are submitted with the same token, the non-atomic validation window allows multiple requests to pass validation before any is marked consumed. This affects Mattermost server versions across the 10.11, 11.3, 11.4, and 11.5 release branches, as indicated by the CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Mattermost Server version 10.11.13 or later for the 10.11 branch, 11.3.3 or later for the 11.3 branch, 11.4.3 or later for the 11.4 branch, or 11.5.1 or later for the 11.5 branch. The patch implements atomic token consumption logic to prevent reuse of magic link tokens across concurrent requests. Until patching is feasible, disable or restrict guest magic link authentication in access control policies if possible, and implement rate limiting on authentication endpoints to mitigate concurrent request exploitation. Consult https://mattermost.com/security-updates for detailed patch availability and upgrade instructions.