Mattermost versions 10.11.x up to 10.11.12, 11.5.x up to 11.5.0, 11.4.x up to 11.4.2, and 11.3.x up to 11.3.2 fail to enforce atomic single‑use consumption of guest magic link tokens, allowing an attacker with a valid magic link to open multiple independent authenticated sessions through concurrent requests. This flaw lets an attacker impersonate any guest user, access private channels, and potentially read or modify sensitive data. The weakness is a race condition (CWE‑367) that compromises authentication integrity.

Mattermost; affected versions are 10.11.x up to 10.11.12, 11.5.x up to 11.5.0, 11.4.x up to 11.4.2, and 11.3.x up to 11.3.2. The advisory identifies these releases as vulnerable and recommends upgrading to 11.6.0, 10.11.13, 11.5.1, 11.4.3, or 11.3.3 and newer.

The CVSS score of 6.5 indicates a medium‑to‑high severity. Because the EPSS score is not available and the vulnerability is not listed in KEV, the likelihood of immediate exploitation is unknown, yet the flaw could be leveraged by anyone who has intercepted or phished a magic link. The attacker must make concurrent requests with the same magic link, a scenario that is achievable from a remote position. If successful, the attacker gains persistent, unauthenticated access until the session is terminated.