tocsin

CVE-2026-9162

2 advisories.

Go/github.com/mattermost/mattermost-server CVE-2026-9162: medium 4.3

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation

Action: Upgrade github.com/mattermost/mattermost-server to 10.11.18 or later.

go get github.com/mattermost/mattermost-server@v11.7.1
go get github.com/mattermost/mattermost-server@v11.6.3
go get github.com/mattermost/mattermost-server@v11.5.6
go get github.com/mattermost/mattermost-server@v10.11.18

Affected

introducedfixedlast affected
11.7.011.7.1-
11.6.011.6.3-
11.5.011.5.6-
10.11.010.11.18-

Fixed versions

11.7.111.6.311.5.610.11.18

Sources

CVE-2026-9162 · published · modified · JSON

Go/github.com/mattermost/mattermost-server CVE-2026-9162: unknown

Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 10.11.18+incompatible or later.

go get github.com/mattermost/mattermost-server@v10.11.18+incompatible
go get github.com/mattermost/mattermost-server@v11.5.6+incompatible
go get github.com/mattermost/mattermost-server@v11.6.3+incompatible
go get github.com/mattermost/mattermost-server@v11.7.1+incompatible

Affected

introducedfixedlast affected
10.11.0+incompatible10.11.18+incompatible-
11.5.0+incompatible11.5.6+incompatible-
11.6.0+incompatible11.6.3+incompatible-
11.7.0+incompatible11.7.1+incompatible-

Fixed versions

10.11.18+incompatible11.5.6+incompatible11.6.3+incompatible11.7.1+incompatible

Sources

CVE-2026-9162 · published · modified · JSON