Mattermost versions 10.11.x through 10.11.13 and 11.5.x through 11.5.1 fail to verify that the refreshed token differs from the original invite token during remote cluster invite confirmation. This flaw permits an authenticated attacker to send a crafted confirmation request that reuses the original token, allowing the attacker to bypass token rotation and gain cluster invitation privileges that should require a new, distinct token. The vulnerability can be categorized as an authorization bypass (CWE‑863).

Mattermost releases 10.11.0 up to 10.11.13 and 11.5.0 up to 11.5.1 are affected. The flaw is specific to the remote cluster invite confirmation workflow used by these versions.

The CVSS score of 3.7 places the vulnerability in the low range, and the EPSS score is not available. Mattermost does not list this issue in the CISA KEV catalog. Exploitation requires the attacker to already be authenticated to the Mattermost instance and to be able to craft an invite confirmation request. The only prerequisite is legitimate authentication, after which the attacker can bypass token rotation and reuse a previously issued cluster invite token. Given the current evidence, the likelihood of exploitation is moderate due to the need for authenticated access, but the impact of gaining unauthorized cluster membership is significant.