What is the CVSS score of CVE-2026-9597?

CVE-2026-9597 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Mattermost CVE-2026-9597

EUVD-2026-43315 MEDIUM

Authentication Bypass by Primary Weakness (CWE-305)

2026-07-13 Mattermost

GHSA-42ff-p8fr-h5jr

Information Disclosure Mattermost

5.4

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects required prior guest-account context; C:L/I:L bounded to existing guest channel permissions; A:N as no service disruption applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:05 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation.. Mattermost Advisory ID: MMSA-2026-00681

AnalysisAI

Deactivated guest accounts in Mattermost 11.6.x through 11.6.4 and 11.7.x through 11.7.2 can regain platform access using magic-link tokens issued before deactivation, because the magic-link login path omits an account-status check during session creation. This directly undermines guest account revocation as an access control mechanism - administrators who deactivate a guest account expecting immediate exclusion will find the control is defeatable while any pre-issued token remains valid. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Mattermost is a self-hosted team messaging and collaboration platform offering a 'guest' account tier with narrowly scoped channel access. Its magic-link authentication flow issues one-time tokens to users for passwordless login - typically delivered via email. CWE-305 (Authentication Bypass by Primary Weakness) identifies the root cause: a mandatory prerequisite check - verifying that the account is active - is absent on the magic-link session-creation code path, even though it presumably exists on other login paths. The CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covers all Mattermost application variants in the affected version ranges. The vulnerability is scoped exclusively to guest accounts and the magic-link login path; standard credential-based and SSO login paths are not implicated by the description.

RemediationAI

The primary remediation is to upgrade Mattermost to a version that addresses MMSA-2026-00681 - exact fixed version numbers are not specified in the available data and should be confirmed directly via the Mattermost security advisory at https://mattermost.com/security-updates before deployment. As an immediate compensating control prior to patching, administrators should explicitly invalidate all active sessions for any deactivated guest accounts using the Mattermost System Console (System Console > User Management) or the Mattermost REST API's session revocation endpoint, rather than relying solely on account deactivation. Additionally, reducing the magic-link token validity window limits the exploitation window for pre-issued tokens - note that this affects all magic-link users, not only guests. Simply deactivating a guest account is insufficient under affected versions; session and token revocation must be performed explicitly.