CVE-2026-3590: Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement

April 17, 2026 (updated April 28, 2026)

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests. Mattermost Advisory ID: MMSA-2026-00624.

References

github.com/advisories/GHSA-mh4x-rmrx-3hp4
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-3590

Code Behaviors & Features

Detect and mitigate CVE-2026-3590 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →