What is the CVSS score of EUVD-2026-38247?

EUVD-2026-38247 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Mattermost EUVD-2026-38247

Q: Which versions of Mattermost are affected by EUVD-2026-38247?

WebSocket session persistence in Mattermost allows authenticated users whose sessions have been globally revoked to bypass that revocation and continue receiving real-time platform events.

| CVE-2026-9162 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-06-22 Mattermost

GHSA-h998-hxxj-8q83

Mattermost Information Disclosure

4.3

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires authenticated low-privileged session (PR:L); impact is confidentiality-only via continued event stream receipt; no integrity or availability consequence applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 14:40 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664

AnalysisAI

WebSocket session persistence in Mattermost allows authenticated users whose sessions have been globally revoked to bypass that revocation and continue receiving real-time platform events. Affected across four actively maintained release branches (11.7.x, 11.6.x, 11.5.x, 10.11.x), the flaw directly undermines the effectiveness of administrative session revocation - a control relied upon in account-compromise response and offboarding workflows. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); the EPSS signal is absent from available data, and the vendor-assigned CVSS of 4.3 reflects correctly scoped, medium-severity risk.

Technical ContextAI

Mattermost is a self-hosted and cloud-deployed team collaboration platform that uses persistent WebSocket connections to push real-time messaging events - new messages, user presence, channel updates - to connected clients. The vulnerable component is the server-side session validation layer governing those long-lived WebSocket connections. When a global session revocation is triggered (e.g., via an admin 'Revoke All Sessions' action), the server correctly invalidates the backing database session records but does not flush or re-evaluate the in-memory cached authentication state for WebSocket connections that were already established before the revocation event. CWE-613 (Insufficient Session Expiration) is the precise root cause class: the system fails to enforce session termination across all active transport channels simultaneously. The CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* spans all Mattermost application editions. The vulnerability is architectural - it reflects a gap between the database-layer session lifecycle and the WebSocket connection lifecycle.

RemediationAI

Upgrade to the patched Mattermost release for the applicable branch per vendor advisory MMSA-2026-00664, available at https://mattermost.com/security-updates. Exact fixed version numbers for each branch (11.7.x, 11.6.x, 11.5.x, 10.11.x) are not independently confirmed from the available input data and must be verified against the advisory before upgrading. As a compensating control pending patching, administrators can restart the Mattermost server process, which forcibly terminates all active WebSocket connections and requires all clients to re-establish connections and re-authenticate - clients holding revoked sessions will then be denied; note this causes a brief service interruption for all users. For targeted incidents involving a specific user, revoking their session and immediately disabling their account reduces the exposure window, since a disabled account cannot re-authenticate if the connection drops. Network-layer controls (firewall or reverse proxy rules) to block a specific user's IP are a fragile workaround and not recommended as a primary mitigation given dynamic and shared IP environments.