3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-4273

CVE-2026-4273: Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-4273

CVE-2026-4273:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260313190740-742e0be95074	8.0.0-20260313190740-742e0be95074
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260313190740-742e0be95074	5.3.2-0.20260313190740-742e0be95074

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit 742e0be9507454a7e662668e1d9ec1b94b636e9b clearly indicates the source of the vulnerability. The patch modifies the ReceiveInviteConfirmation function in server/platform/services/remotecluster/recv.go. Specifically, it adds a conditional check to verify that the RefreshedToken from a remote cluster invite confirmation is not the same as the original token. The absence of this check in vulnerable versions allowed an attacker to bypass token rotation by sending a crafted confirmation with the same token. The added code if confirm.RefreshedToken == rc.Token and the subsequent error handling directly address this flaw. Therefore, the ReceiveInviteConfirmation function is the exact location of the vulnerability.

Vulnerable functions

remotecluster.Service.ReceiveInviteConfirmation

server/platform/services/remotecluster/recv.go

The vulnerability lies in the `ReceiveInviteConfirmation` function, which, before the patch, did not validate whether the `RefreshedToken` provided in the invite confirmation was different from the original token. This allowed an attacker to reuse the original invite token, bypassing the intended token rotation mechanism. The patch introduces a check to ensure the `RefreshedToken` is not the same as the existing token (`rc.Token`), thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.