CVE-2026-53824

MEDIUM

Mattermost < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay

Title source: cna
STIX 2.1

Description

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Attackers can exploit stale token acceptance to invoke slash command behavior briefly after token revocation, potentially executing unauthorized actions depending on operator configuration.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: Mattermost < 2026.4.24 - Slash Token Revocation Lag via Monitor Refresh Delay
https://www.vulncheck.com/advisories/mattermost-slash-token-revocation-lag-via-monitor-refresh-delay
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-4m3v-q747-pc6h)
https://github.com/openclaw/openclaw/security/advisories/GHSA-4m3v-q747-pc6h

Scores

CVSS v3 6.5
EPSS 0.0018
EPSS Percentile 7.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-613
Status published
Products (2)
OpenClaw/OpenClaw < 2026.4.24
OpenClaw/OpenClaw 2026.4.24
Published Jun 12, 2026
Tracked Since Jun 13, 2026