What is the CVSS score of CVE-2026-4273?

CVE-2026-4273 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4273?

Yes, a patch is available for CVE-2026-4273. Update the affected software to the latest version immediately.

Mattermost CVE-2026-4273

Q: Which versions of Mattermost are affected by CVE-2026-4273?

Authenticated attackers can bypass token rotation in Mattermost's remote cluster invite confirmation process by reusing original invite tokens.. A patch is available.

EUVD-2026-30740 LOW

Incorrect Authorization (CWE-863)

2026-05-18 Mattermost

GHSA-hqpj-f3jh-29vx

Mattermost Authentication Bypass

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:15 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

AnalysisAI

Authenticated attackers can bypass token rotation in Mattermost's remote cluster invite confirmation process by reusing original invite tokens. The flaw affects Mattermost Server versions 11.5.x through 11.5.1 and 10.11.x through 10.11.13, allowing token reuse despite intended security controls. While rated low severity (CVSS 3.7), this represents an authentication bypass vulnerability (CWE-863) that undermines session management security. No active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability stems from incorrect authorization implementation (CWE-863) in Mattermost's remote cluster invitation workflow. The remote cluster feature enables federated communication between separate Mattermost instances. During invite confirmation, the system is designed to rotate invite tokens for security - the RefreshedToken should differ from the original invite token to prevent reuse. However, the affected versions fail to validate that RefreshedToken actually differs from the original token. An attacker can craft an invite confirmation request where RefreshedToken equals the original token, effectively bypassing the rotation mechanism. This violates the principle that security tokens should be single-use or properly rotated to prevent replay attacks. The CPE string (cpe:2.3:a:mattermost:mattermost) confirms this affects the core Mattermost server product across two major version branches.

RemediationAI

Upgrade to Mattermost Server version 11.5.2 or later for the 11.5.x branch, or version 10.11.14 or later for the 10.11.x branch. Patched versions implement proper validation ensuring RefreshedToken differs from the original invite token during remote cluster invite confirmation. Consult Mattermost Advisory MMSA-2026-00575 at https://mattermost.com/security-updates for official patch release details and upgrade instructions. If immediate patching is not feasible, temporarily disable the remote cluster invitation feature through Mattermost system console settings (System Console > Environment > Cluster), though this eliminates federated cluster functionality and may impact business operations requiring cross-instance communication. Additionally, audit existing remote cluster invitations and tokens, revoking and regenerating any tokens that may have been reused, though detecting past exploitation may be difficult without comprehensive invite confirmation logging.