CVE-2026-9597

MediumCVSS 5.4/10Last modified Jul 13, 2026

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation.. Mattermost Advisory ID: MMSA-2026-00681

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Jul 13, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-959858.8The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into CVE-2026-95994.3The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to CVE-2026-960129.9IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that CVE-2026-96026.5Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Mattermost Web App to the Desktop App which all CVE-2026-96036.5A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /a CVE-2026-960397.2The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and CVE-2026-96044.3A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The ma CVE-2026-960448.8No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-96057.3A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwg CVE-2026-96067.3A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. CVE-2026-96076.3A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcel_lis CVE-2026-960717.5Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.