CVE-2026-9597: Mattermost Server Auth Bypass Vulnerability

CVE-2026-9597 Overview

CVE-2026-9597 is an authentication bypass vulnerability in Mattermost Server. The flaw affects Mattermost versions 11.7.x <= 11.7.2 and 11.6.x <= 11.6.4. The magic-link token login path fails to verify whether a guest account is deactivated before creating a session. A deactivated guest user can present a magic-link token issued before deactivation and obtain a fully functional session. The issue is tracked as Mattermost Advisory ID MMSA-2026-00681 and classified under [CWE-305: Authentication Bypass by Primary Weakness]. The vulnerability requires low privileges over the network and impacts confidentiality and integrity of the collaboration platform.

Critical Impact
A deactivated guest user can reuse a previously issued magic-link token to establish a valid, authenticated session, effectively bypassing the account deactivation control.

Affected Products

Mattermost Server versions 11.7.0 through 11.7.2
Mattermost Server versions 11.6.0 through 11.6.4
Deployments using magic-link token authentication for guest accounts

Discovery Timeline

2026-07-13 - CVE-2026-9597 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-9597

Vulnerability Analysis

Mattermost supports magic-link tokens as a passwordless authentication mechanism. When a user clicks a magic-link, the server validates the token and creates an authenticated session. The vulnerable code path validates the token signature and expiry but omits a check on the target account state. Administrators expect deactivation to immediately terminate access, yet the token remains usable until it expires.

An attacker holding a valid, unexpired magic-link token for a guest account can bypass the deactivation control. The resulting session grants access to channels, messages, and files that the guest account was authorized to view prior to deactivation. Because the platform is used for internal collaboration, this exposure can include sensitive project and customer data.

The vulnerability is scoped to guest accounts using the magic-link login path. Standard credential-based logins and single sign-on flows are not affected by this specific defect.

Root Cause

The root cause is a missing account state check in the magic-link token login handler. The handler validates token integrity but never queries the Active or DeleteAt attributes of the associated user record before issuing a session. This is a classic instance of [CWE-305], where authentication succeeds despite a primary condition (account activation status) failing.

Attack Vector

Exploitation requires the attacker to possess a magic-link token issued before their guest account was deactivated. The attacker submits the token to the Mattermost login endpoint over the network. The server accepts the token, skips the deactivation check, and returns a valid session cookie. The attacker then interacts with the API and web client using that session, regaining the permissions held prior to deactivation.

No user interaction from an administrator is required. Exploitation succeeds only within the token's validity window, which limits the attack surface but does not eliminate it. Refer to the Mattermost Security Updates advisory for additional technical detail.

Detection Methods for CVE-2026-9597

Indicators of Compromise

Successful session creation events tied to user accounts whose DeleteAt timestamp is non-zero or whose state is deactivated
Magic-link login events (api/v4/users/login/token or equivalent) occurring after an administrative deactivation event for the same user
Guest account activity in audit logs following a deactivation action, particularly channel reads, file downloads, or API calls

Detection Strategies

Correlate Mattermost audit logs with user administration events to identify sessions established after a deactivation timestamp
Alert on any authentication event where the authenticated user record shows deleteAt > 0 at the time of session creation
Baseline magic-link token usage by account type and flag anomalous logins from guest accounts recently removed from the tenant

Monitoring Recommendations

Ingest Mattermost server logs and audit events into a centralized logging platform for correlation with identity lifecycle changes
Monitor the /api/v4/users/login endpoints for token-based authentications and enrich events with current user state
Track file access and channel membership changes performed by guest sessions in the 24 hours following any deactivation

How to Mitigate CVE-2026-9597

Immediate Actions Required

Upgrade Mattermost Server to a patched release above 11.7.2 for the 11.7.x branch or above 11.6.4 for the 11.6.x branch as listed in the vendor advisory
Invalidate all outstanding magic-link tokens for guest accounts, particularly any accounts that were deactivated within the token validity window
Review audit logs for magic-link logins performed by deactivated guest accounts and terminate any active sessions found

Patch Information

Mattermost has published fixed releases through the Mattermost Security Updates portal under advisory MMSA-2026-00681. Administrators should apply the vendor-supplied patch that adds the missing account state validation to the magic-link token login handler. After patching, restart the Mattermost server and confirm that deactivated guest accounts can no longer establish sessions using previously issued tokens.

Workarounds

Disable magic-link authentication for guest accounts until the patched release is deployed
Reduce the magic-link token lifetime configuration to minimize the exploitation window for any issued tokens
Force a bulk revocation of active sessions and outstanding tokens after each guest deactivation as a compensating control

bash

# Configuration example
# Verify installed Mattermost server version
mattermost version

# Force session revocation for a specific guest user after deactivation
mattermost user deactivate guest@example.com
mattermost user session revoke guest@example.com