Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.. Mattermost Advisory ID: MMSA-2026-00704

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T15:16:53.967Z",
  "pubdate": "2026-08-17T15:16:53.967Z",
  "executiveSummary": "An improper authorization vulnerability exists in Mattermost versions 11.7.x <= 11.7.6 and 10.11.x <= 10.11.21.\nThe flaw allows an OAuth app utilizing a delegated user token to improperly access and interact with account-management endpoints designed specifically for direct user sessions.\nSpecifically, the vulnerability fails to restrict OAuth deauthorization and personal access token management endpoints, allowing a compromised or malicious OAuth application to revoke the victim user's authorizations or invalidate tokens associated with other third-party integrations.\nThe business impact includes unauthorized disruption of user integrations, potential session termination, and loss of service availability for connected applications.\nThe threat actor requires a delegated user token acquired through the OAuth authorization flow to execute the attack.\nRisk implications remain moderate to high depending on the sensitivity of the integrations deployed within the affected Mattermost instance.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control validation on account-management endpoints within Mattermost.\nThe vulnerable components are the OAuth deauthorization and personal access token management handlers, which fail to properly verify whether an incoming request originates from an interactive, direct user session rather than an automated delegated OAuth token context.\nAffected software includes Mattermost versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21.\nAuthentication requirements involve the attacker obtaining a valid delegated user token via standard OAuth authorization grant mechanisms.\nPrivilege requirements are limited to standard user privileges; however, the vulnerability allows the delegated application to exceed its intended permission boundary by acting on account-management routes.\nNetwork exposure encompasses the standard web and API interfaces exposed by the Mattermost server.\nThe step-by-step attack flow proceeds as follows:\n1. The attacker induces a user to authorize a malicious or compromised OAuth application within Mattermost, resulting in the issuance of a delegated user token.\n2. Instead of operating strictly within the scoped permissions of the OAuth integration, the application crafts HTTP requests directed at the internal account-management endpoints responsible for personal access token management and OAuth deauthorization.\n3. Because the application layer fails to enforce strict session-context checks on these endpoints, the server processes the requests coming from the delegated token context.\n4. The malicious application successfully executes administrative-level revocation logic against the user's account, forcibly revoking authorizations and invalidating personal access tokens or tokens belonging to entirely separate integrations.\nPost-exploitation impact includes denial of service for affected integrations, disruption of automated workflows, and potential cascading authentication failures across connected services."
}