CVE-2026-9162

MediumCVSS 4.3/10Last modified Jun 23, 2026

Description

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.7.0, <= 11.7.0; >= 11.6.0, <= 11.6.2; >= 11.5.0, <= 11.5.5; >= 10.11.0, <= 10.11.17

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jun 22, 2026
Last modified: Jun 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-916229.3Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage CVE-2026-916237.4Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage CVE-2026-916249.1Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage CVE-2026-916258.2Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage CVE-2026-916277.8Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported CVE-2026-916285.5Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Support CVE-2026-916294.7Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported CVE-2026-91639.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Mana CVE-2026-916306.8Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabil CVE-2026-916315.0Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabil CVE-2026-916327.7Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabil CVE-2026-916336.0Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabil