tocsin

Go/github.com/mattermost/mattermost/server/v8 CVE-2026-4273: low 3.7, EPSS 0.14%

Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260313190740-742e0be95074 or later.

go get github.com/mattermost/mattermost/server/v8@v11.5.2
go get github.com/mattermost/mattermost/server/v8@v10.11.14
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260313190740-742e0be95074

Affected

introducedfixedlast affected
11.5.011.5.2-
10.11.010.11.14-
08.0.0-20260313190740-742e0be95074-

Fixed versions

11.5.210.11.148.0.0-20260313190740-742e0be95074

Sources

CVE-2026-4273 · published · modified · JSON