Cyber Resilience

CVE-2026-3590

Race Condition in Mattermost Server 10.11.0 – 10.11.13

Race Condition
Published
15 April 2026
Modified
22 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0014 4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-3590 is a medium-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent…

more

authenticated sessions via concurrent requests.. Mattermost Advisory ID: MMSA-2026-00624

CWE(s)
CWE-367

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Race condition in public-facing auth token handling directly enables reuse of guest magic links for multiple sessions via concurrent requests to the application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-6343Same product: Mattermost Mattermost Server
CVE-2026-6673Same product: Mattermost Mattermost Server
CVE-2026-6339Same product: Mattermost Mattermost Server
CVE-2026-26304Same product: Mattermost Mattermost Server
CVE-2026-10106Same product: Mattermost Mattermost Server
CVE-2026-20796Same product: Mattermost Mattermost Server
CVE-2026-24692Same product: Mattermost Mattermost Server
CVE-2026-10085Same product: Mattermost Mattermost Server
CVE-2026-4055Same product: Mattermost Mattermost Server
CVE-2026-6342Same product: Mattermost Mattermost Server

Affected Assets

mattermost
mattermost server
10.11.0 — 10.11.13 · 11.3.0 — 11.3.3 · 11.4.0 — 11.4.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • IA-5 Authenticator Management
  • SC-23 Session Authenticity
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces single-use consumption of the magic-link authenticator so concurrent requests cannot create multiple sessions.

IA-5 Authenticator Management good match
prevent

Requires proper management of guest magic-link authenticators, including atomic invalidation after first use to block replay.

SC-23 Session Authenticity partial match
prevent

Ensures session authenticity tokens cannot be concurrently redeemed, limiting the impact of the TOCTOU flaw.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.17 Clock synchronization none match
none

Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.

References