CVE-2026-9597

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.6.x through 11.6.4 Mattermost versions 11.7.x through 11.7.2

Description The software fails to verify the activation status of a guest account during the session creation process in the magic-link token login path. This allows a deactivated guest user to obtain a fully functional session if they possess a magic-link token that was issued before the account was deactivated.

Recommendations Update Mattermost versions 11.6.x to a version newer than 11.6.4. Update Mattermost versions 11.7.x to a version newer than 11.7.2.