CVE-2026-9162: Mattermost WebSocket Session Revocation Bypass – CVSS 4.3

Technical summary

The vulnerability stems from incomplete cache invalidation in Mattermost's WebSocket authentication layer. During global session revocation, the application correctly invalidates standard HTTP sessions but neglects to revoke cached authentication tokens for persistent WebSocket connections. CWE-613 (Insufficient Session Expiration) classifies this gap. A user maintaining an open WebSocket connection at the time of session revocation will retain access because the server does not actively challenge or invalidate the cached authentication state on the persistent channel. The session persists until either the client-side cache timeout is reached or the client voluntarily reconnects and must re-authenticate.

Business impact

For organizations using Mattermost as their primary team collaboration platform, this vulnerability creates a window of continued unauthorized access after session revocation. In regulated industries (finance, healthcare, government), this delays compliance with data access controls and incident response procedures. When a user is terminated or credentials are compromised, the delay in actual access termination—potentially hours depending on cache timeout settings—increases exposure to data leakage or lateral movement. Teams and channels that should be immediately restricted remain accessible to a departing or compromised user.

Affected systems

Mattermost Server is affected in the following versions: 11.7.x up to and including 11.7.0; 11.6.x up to and including 11.6.2; 11.5.x up to and including 11.5.5; and 10.11.x up to and including 10.11.17. Versions below these thresholds are unaffected. The issue is specific to Mattermost Server and does not directly affect Mattermost clients or third-party integrations, though any client maintaining an active WebSocket connection is vulnerable to the continuation of the expired session.

Exploitability

Exploitation requires an existing WebSocket connection established before the global session revocation occurs. An attacker cannot remotely initiate a new connection; they must already be authenticated and connected at the moment the administrator revokes their session. This limits the attack surface to active sessions, reducing opportunistic exploitation potential. However, the ease of maintaining a persistent connection—especially in a work-from-home environment where users may leave browsers open—means the risk is material. An attacker who has compromised a user account has a high probability of maintaining an active connection, and administrators may not notice the breach until the cache expires.

Remediation

Organizations should upgrade to patched versions as released by Mattermost. Verify against the vendor's official advisory (MMSA-2026-00664) for confirmed fixed version numbers. As an interim control, administrators can mitigate risk by reducing the WebSocket cache timeout configuration if available in your deployment, forcing more frequent re-authentication. Additionally, monitor for unusual activity on revoked accounts and train teams on the importance of closing browsers and re-logging in after credential compromise or offboarding.

Patch guidance

Consult Mattermost's official advisory MMSA-2026-00664 for the specific patched versions applicable to your release branch. If you are running 11.7.0, 11.6.2, 11.5.5, or 10.11.17 (or earlier within those branches), a patch is available. Plan upgrades during a maintenance window, as WebSocket connections will be disrupted during server restart, forcing clients to reconnect and re-authenticate. This forced reconnection is actually beneficial as it clears the vulnerable cached state. Test in a staging environment first to confirm compatibility with your custom integrations or plugins.

Detection guidance

Monitor WebSocket connection logs for sessions that persist after global revocation events. If your Mattermost deployment logs authentication state changes and connection lifecycle events, look for entries showing a user receiving real-time events (presence updates, message notifications) after their session was administratively revoked. This can be correlated with admin audit logs showing a 'revoke session' action. Alerting on this pattern is impractical without additional instrumentation, so prioritize log review during post-incident analysis. Network monitoring of WebSocket frame payloads is not recommended due to encryption and complexity; rely instead on application-level logs and audit trails.

Why prioritize this

Although this vulnerability has a CVSS score of 4.3 (Medium), its context matters. The attack requires pre-existing authentication and happens only after an administrator has already taken action to revoke access—a relatively rare triggering condition. However, the condition directly contradicts the intended security control (session revocation), making it high-priority for environments with strong offboarding procedures, high-value data in Mattermost, or regulatory requirements for immediate access termination. Organizations should patch within 60 days; those handling sensitive data should accelerate to 30 days.

Risk score, explained

CVSS 4.3 reflects a network-adjacent attack (WebSocket over the same network as HTTP), requiring prior authentication and user interaction (the user must have an active connection). Confidentiality impact is Low because the attacker reads messages on teams they were already a member of; there is no elevation of privilege or new access. No integrity or availability impact is scored. The risk is heightened by the fact that the vulnerability directly undermines a critical administrative control—session revocation—and organizations relying on Mattermost for confidential team communication should consider their operational context. A CVSS of 4.3 should not minimize the patch priority in high-security environments.

Frequently asked questions