CVE-2026-9162
published 2026-06-22CVE-2026-9162: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.33%
26.6th percentile
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.11.0 < 10.11.18 | 10.11.18 |
| github.com | mattermost_mattermost-server | >= 11.5.0 < 11.5.6 | 11.5.6 |
| github.com | mattermost_mattermost-server | >= 11.6.0 < 11.6.3 | 11.6.3 |
| github.com | mattermost_mattermost-server | >= 11.7.0 < 11.7.1 | 11.7.1 |
| mattermost | mattermost | 10.11.0 – 10.11.17 | — |
| mattermost | mattermost | 11.5.0 – 11.5.5 | — |
| mattermost | mattermost | 11.6.0 – 11.6.2 | — |
| mattermost | mattermost | 11.7.0 – 11.7.0 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.18 | 10.11.18 |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.6 | 11.5.6 |
| mattermost | mattermost_server | >= 11.6.0 < 11.6.3 | 11.6.3 |
| mattermost | mattermost_server | >= 11.7.0 < 11.7.1 | 11.7.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 11.7.x Websocket Connection session expiration
vuldb·2026-06-22·CVSS 4.3
CVE-2026-9162 [MEDIUM] Mattermost up to 11.7.x Websocket Connection session expiration
A vulnerability classified as problematic has been found in Mattermost up to 10.11.17/11.5.5/11.6.2/11.7.0/11.7.x. This affects an unknown part of the component Websocket Connection Handler. Performing a manipulation results in session expiration.
This vulnerability was named CVE-2026-9162. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revo
ghsa_unreviewed·2026-06-22
CVE-2026-9162 [MEDIUM] CWE-613 Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revo
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664
GHSA
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation
ghsa·2026-06-22
CVE-2026-9162 [MEDIUM] CWE-613 Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to invalidate cached authentication state for active WebSocket connections during global session revocation, which allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.. Mattermost Advisory ID: MMSA-2026-00664
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published