---
id: CVE-2026-4273
title: >-
  Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate
  that the RefreshedToken differs from the original invite token during remote
  cluster invite confirmation which allows an authenticated attacker to bypass
  token ro…
summary: >-
  Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate
  that the RefreshedToken differs from the original invite token during remote
  cluster invite confirmation which allows an authenticated attacker to bypass
  token ro…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.14'
  - 'mattermost_server >= 11.5.0, < 11.5.2'
patched:
  - mattermost_server 11.5.2
published: '2026-05-18'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-4273'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.00237
epssPercentile: 0.13629
ingestedAt: '2026-10-14T20:53:12.296Z'
---

## Overview

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a crafted invite confirmation with a RefreshedToken matching the original token. Mattermost Advisory ID: MMSA-2026-00575

## Affected

- `mattermost_server >= 10.11.0, < 10.11.14`
- `mattermost_server >= 11.5.0, < 11.5.2`

## Remediation

Upgrade past the affected range:

- `mattermost_server 11.5.2`