CVE-2026-9162
published 2026-06-22CVE-2026-9162: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.20%
10.2th percentile
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mattermost | mattermost | 10.11.0 – 10.11.17 | — |
| mattermost | mattermost | 11.5.0 – 11.5.5 | — |
| mattermost | mattermost | 11.6.0 – 11.6.2 | — |
| mattermost | mattermost | 11.7.0 – 11.7.0 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.18 | 10.11.18 |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.6 | 11.5.6 |
| mattermost | mattermost_server | >= 11.6.0 < 11.6.3 | 11.6.3 |
| mattermost | mattermost_server | >= 11.7.0 < 11.7.1 | 11.7.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 11.7.x Websocket Connection session expiration
vuldb·2026-06-22·CVSS 4.3
CVE-2026-9162 [MEDIUM] Mattermost up to 11.7.x Websocket Connection session expiration
A vulnerability classified as problematic has been found in Mattermost up to 10.11.17/11.5.5/11.6.2/11.7.0/11.7.x. This affects an unknown part of the component Websocket Connection Handler. Performing a manipulation results in session expiration.
This vulnerability was named CVE-2026-9162. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revo
ghsa_unreviewed·2026-06-22
CVE-2026-9162 [MEDIUM] CWE-613 Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revo
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published