VYPR
← All advisories
Medium severity6.2NVD Advisory· Published Jun 16, 2023· Updated Jun 17, 2026

CVE-2023-2788

CVE-2023-2788

Description

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Mattermost/Mattermost4 versions
    cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*range: >=7.1.0,<=7.1.9
    • cpe:2.3:a:mattermost:mattermost:7.10.0:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.