CVE-2026-9571: Mattermost Server Auth Bypass Vulnerability

CVE-2026-9571 Overview

CVE-2026-9571 affects Mattermost Server versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. The vulnerability stems from the server failing to invalidate OAuth refresh tokens when a user account is deactivated. A deactivated user, or an attacker who has captured a valid refresh token, can request new functional access tokens through the OAuth refresh token grant endpoint. This weakness is tracked as [CWE-305: Authentication Bypass by Primary Weakness] and is documented in Mattermost Advisory MMSA-2026-00680.

Critical Impact
Deactivated accounts retain the ability to mint new OAuth access tokens, granting continued read access to protected resources despite the account being disabled.

Affected Products

Mattermost Server 11.7.x through 11.7.2
Mattermost Server 11.6.x through 11.6.4
Mattermost Server 10.11.x through 10.11.19

Discovery Timeline

2026-07-13 - CVE-2026-9571 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-9571

Vulnerability Analysis

The vulnerability is an authentication bypass caused by improper session lifecycle management in Mattermost's OAuth 2.0 implementation. When an administrator deactivates a user account, the server terminates active sessions but does not revoke previously issued OAuth refresh tokens. The refresh token grant endpoint continues to accept these tokens and issues fresh access tokens to the caller.

This breaks the security expectation that account deactivation removes all authenticated access paths. An attacker in possession of a stolen refresh token can maintain persistent read access to the user's confidential data, even after security teams believe the account has been disabled. The vulnerability yields high confidentiality impact with no impact to integrity or availability.

Root Cause

The root cause is missing linkage between the user deactivation code path and the OAuth token store. The RefreshToken grant handler validates only that the refresh token itself is well-formed, unexpired, and signed. It does not consult the user's active status before minting new access tokens. This is a business logic flaw classified under [CWE-305].

Attack Vector

Exploitation requires the attacker to possess a valid OAuth refresh token for a deactivated account. This applies to two scenarios: a legitimate but subsequently deactivated user who retains their token, or an external attacker who exfiltrated the token before deactivation. The attacker submits the refresh token to the standard OAuth token endpoint with grant_type=refresh_token and receives a new access token in return. The attack is executed remotely over the network with low complexity and requires only low privileges.

No public proof-of-concept code has been released for CVE-2026-9571. See the Mattermost Security Updates advisory for vendor-provided technical details.

Detection Methods for CVE-2026-9571

Indicators of Compromise

OAuth token endpoint (/oauth/access_token) requests using grant_type=refresh_token where the associated user account is in a deactivated state.
Successful access token issuance events followed by API calls from IP addresses or user agents not associated with the user's historical activity.
Continued API access under a user identifier after an administrative deactivation event has been logged.

Detection Strategies

Correlate Mattermost audit logs for user.deactivate events against subsequent OAuth token issuance events for the same user ID.
Alert on any refresh_token grant that produces an access token for an account whose DeleteAt field is non-zero.
Baseline OAuth refresh activity per user and flag refresh operations that occur after account state transitions.

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized SIEM with retention sufficient to correlate deactivation and token refresh events.
Monitor the OAuth token endpoint for anomalous request volumes originating from single client IDs.
Track OAuth client applications with active refresh tokens and reconcile against the current active user list on a scheduled basis.

How to Mitigate CVE-2026-9571

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.7.2, 11.6.4, or 10.11.19 as published in the vendor advisory.
Manually revoke all OAuth refresh tokens associated with any user account that has been deactivated on affected versions.
Audit the OAuth token store for tokens tied to deactivated accounts and purge them before applying the patch.
Review recent access logs for deactivated users to confirm no unauthorized token refresh activity has occurred.

Patch Information

Mattermost has released fixed versions addressing the token invalidation defect. Refer to the Mattermost Security Updates page and advisory MMSA-2026-00680 for the specific patched build numbers and upgrade guidance.

Workarounds

If immediate patching is not feasible, disable or restrict OAuth 2.0 application authorization in Mattermost system settings.
Establish an operational procedure that pairs every user deactivation with manual OAuth token revocation for that user.
Shorten OAuth refresh token lifetimes to reduce the window during which stolen tokens remain valid.

bash

# Manually revoke OAuth tokens for a deactivated user via mmctl
mmctl oauth list
mmctl user deactivate <username>
# Consult MMSA-2026-00680 for the vendor-provided revocation procedure