CVE-2026-9162

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.17 Mattermost versions 11.5.x through 11.5.5 Mattermost versions 11.6.x through 11.6.2 Mattermost versions 11.7.x through 11.7.0

Description An issue exists where the system fails to invalidate cached authentication state for active WebSocket connections during global session revocation. This allows a user with an existing WebSocket connection to remain authenticated and continue receiving real-time events until the cached session expires or the client reconnects.

Recommendations Update versions 10.11.x through 10.11.17 to a newer version. Update versions 11.5.x through 11.5.5 to a newer version. Update versions 11.6.x through 11.6.2 to a newer version. Update versions 11.7.x through 11.7.0 to a newer version.