Mattermost EUVD-2026-38247

Exploitation requires a pre-existing, authenticated WebSocket connection to the Mattermost server that was established before the global session revocation event occurs. The CVSS vector confirms PR:L - a low-privileged, authenticated account is required; unauthenticated exploitation is not possible. The bypass is only effective during the window between revocation and either natural cache expiry or client reconnection, at which point the client is forced to re-authenticate and will be denied. Information access is bounded by the revoked user's original channel membership and permission scope - no privilege escalation or access to resources the user could not previously see is possible. No non-default server configuration or special deployment mode is required; any standard Mattermost deployment using WebSocket-capable clients (desktop application, web browser, mobile app) is susceptible to this condition.

The vendor-assigned CVSS score of 4.3 (Medium, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained impact: exploitation requires a pre-existing low-privileged authenticated session (PR:L), the scope is unchanged, and impact is limited to partial confidentiality with no integrity or availability consequence. No KEV listing and no publicly available exploit code are confirmed, and no EPSS data was provided in the available intelligence - these signals collectively indicate the vulnerability has not attracted significant exploitation interest at time of analysis. The practical risk is highest in targeted, high-stakes scenarios: specifically, incident response or employee offboarding situations where session revocation is used as a security control and a revoked user (or an attacker who has taken over their credentials) deliberately maintains an active WebSocket connection. The SSVC assessment is: exploitation requires prior authentication and an active connection (not automatable at scale), technical impact is partial and scoped to the revoked user's existing permissions, and no exploitation is confirmed. This is a meaningful architectural gap that reduces the reliability of a specific administrative control, but it does not represent opportunistic mass-exploitation risk.

A terminated employee or an attacker who has compromised a user account keeps their Mattermost desktop or browser client open and connected via WebSocket. An administrator triggers global session revocation as part of the incident response or offboarding process. Despite the revocation, the attacker's client continues receiving real-time channel messages, user activity updates, and other platform events - scoped to the compromised account's original permissions - until the WebSocket connection is naturally dropped or the server is restarted. No public exploit code exists; exploitation is manual and requires deliberate connection maintenance.