CVE-2023-2788

MEDIUM

Mattermost 7.1.0-7.1.8 - Authenticated Missing Authorization via OAuth2 Flow

Title source: llm

Description

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.

References (1)

Core 1

Core References

Vendor Advisory

https://mattermost.com/security-updates/

Scores

CVSS v3 6.2

EPSS 0.0010

EPSS Percentile 26.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-862 CWE-613

Status published

Products (2)

mattermost/mattermost 7.10.0

mattermost/mattermost 7.1.0 - 7.1.9

Published Jun 16, 2023

Tracked Since Feb 18, 2026