CVE-2023-2788 Deactivated user can retain access using oauth2 api

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated...

CVE-2023-2788

Mattermost CVE-2023-2788 describes a failure to validate an admin user’s active status after an OAuth2 flow, allowing an attacker with admin privileges to retain persistent access by obtaining an OAuth2 access token while the attacker’s account is deactivated. Affected platform is Mattermost; the...

CVE-2023-2788 Deactivated user can retain access using oauth2 api

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated...