CVE-2023-2788 — Deactivated user can retain access using oauth2 api
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost b…
Published: 2023-06-16 · CVSS: 6.2 · CVSS 3.1
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7