Mattermost Session Management Vulnerability for Deactivated Guest Accounts

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2 and 11.6.x through 11.6.4, where the application fails to check if a guest account is deactivated before creating a session via the magic-link token login process. This oversight allows a deactivated guest user to gain a fully functional session using a magic-link token that was issued prior to the account's deactivation.

Impact

Exploitation of this vulnerability allows deactivated guest users to create active sessions, potentially leading to unauthorized access or actions within the Mattermost application.

Remediation

Users can upgrade to Mattermost version 11.8.0 or later to address this vulnerability.