What is the CVSS score of CVE-2026-9571?

CVE-2026-9571 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-9571

EUVD-2026-43305 MEDIUM

Authentication Bypass by Primary Weakness (CWE-305)

2026-07-13 Mattermost

GHSA-4v7j-4mvr-5975

Information Disclosure Mattermost

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (Mattermost) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

AV:N for network-accessible OAuth endpoint; AC:H for token-retention precondition; PR:L because the attacker was a regular user, not an administrator.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 13, 2026 - 21:52 NVD

5.9 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Jul 13, 2026 - 09:01 vuln.today

DescriptionNVD

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680

AnalysisAI

Mattermost fails to invalidate OAuth refresh tokens when a user account is deactivated, enabling former users - or any attacker who possesses a valid refresh token - to continue minting functional access tokens against the OAuth refresh token grant endpoint indefinitely after access revocation should have taken effect. All three actively maintained release branches are affected (10.11.x, 11.6.x, 11.7.x), making this a cross-branch session-persistence flaw with high confidentiality and integrity impact on any workspace relying on OAuth-integrated access control. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Retain OAuth refresh token before deactivation

Delivery

Account deactivated by admin

Exploit

Submit refresh token to /oauth/token endpoint

Execution

Receive new valid bearer access token

Persist

Authenticate to Mattermost workspace as deactivated user

Impact

Read or modify workspace data

Access

Retain OAuth refresh token before deactivation

Delivery

Account deactivated by admin

Exploit

Submit refresh token to /oauth/token endpoint

Execution

Receive new valid bearer access token

Persist

Authenticate to Mattermost workspace as deactivated user

Impact

Read or modify workspace data

Vulnerability AssessmentAI

Exploitation	Exploitation requires possession of a valid OAuth refresh token that was issued to the target Mattermost account prior to account deactivation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 5.9 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) warrants scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A recently terminated employee who had authenticated to a third-party OAuth application integrated with Mattermost retains a valid refresh token on their personal device. After their account is deactivated by IT, the former employee calls the Mattermost OAuth refresh endpoint with the retained token, receives a new bearer access token, and proceeds to read private channels, exfiltrate direct messages, and modify posts - all as their former identity - with no indication to administrators that the deactivated account is being used.
Remediation	Patch available per vendor advisory at https://mattermost.com/security-updates (MMSA-2026-00680). … Detailed patch versions, workarounds, and compensating controls in full report.