CVE-2026-9597 Mattermost CVE debrief

Who should care

Administrators and users of Mattermost versions 11.7.x <= 11.7.2 and 11.6.x <= 11.6.4 should be aware of this vulnerability and take necessary actions to protect their systems. This includes reviewing system configurations, updating software, and monitoring for suspicious activity.

Technical summary

The vulnerability exists in the magic-link token login path of Mattermost. When a guest account is deactivated, the system does not properly invalidate existing magic-link tokens. As a result, a deactivated guest user can still obtain a fully functional session using a magic-link token issued before deactivation. This issue arises from the lack of verification for the guest account's status before creating a session. The vulnerability can be addressed by updating Mattermost to a version that fixes this issue and revoking any existing magic-link tokens for guest users.

Defensive priority

Medium

Recommended defensive actions

• Update Mattermost to a version that fixes this vulnerability
• Review and revoke any existing magic-link tokens for guest users
• Monitor for suspicious activity related to guest user sessions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-13T09:16:25.137Z and has not been modified since then. The NVD entry is currently in the 'Received' status. This information is based on the supplied source corpus. Further verification is recommended to confirm the accuracy of this information.

Official resources