CVE-2023-3591

MediumCVSS 4.8

Published: 17/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Mattermost fails to invalidate previously generated password reset tokens when a new reset token is created.

This may lead to unauthorized access to user accounts if an old reset token is used by an unauthorized person.

It is recommended to update Mattermost to the latest version to ensure that old reset tokens are invalidated when new ones are generated.

Original NVD description (English source)

Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.