Mattermost OAuth Token Refresh Vulnerability in Deactivated User Accounts

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. These versions fail to invalidate OAuth refresh tokens when a user account is deactivated. As a result, a deactivated user or an attacker with a valid refresh token can obtain new access tokens through the OAuth refresh token grant endpoint.

Impact

Exploitation of this vulnerability allows deactivated users or attackers with valid refresh tokens to gain unauthorized access to user accounts by obtaining new access tokens.

Remediation

Users can upgrade to Mattermost versions 11.9.0, 11.8.0, 11.7.5, or 11.6.5 to address this vulnerability.