https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T22:44:38.641287+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264322 EUVD-2026-264322 2026-10-07T22:44:38.692585+00:00 EUVD-2026-264322 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13324 fkie_cve-2025-13324 2026-10-07T22:44:38.692632+00:00

Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

 https://cve.radiocsirt.org/vuln/ghsa-x3r8-2hmh-89f5 GHSA-x3r8-2hmh-89f5 — Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation 2026-10-07T22:44:38.692687+00:00

Affected: Go: github.com/mattermost/mattermost, Go: github.com/mattermost/mattermost/server/v8, Go: github.com/mattermost/mattermost-server

Mattermost versions 10.11.x < 10.11.5, 11.0.x < 11.0.4, 10.12.x < 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.