CVE-2023-3591
Lack of previous password reset tokens on new token creation
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Lack of previous password reset tokens on new token creation
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Record
CVE-2023-3591- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2023-44241
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Record
EUVD-2023-44241- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g328-hf66-x5p7
Mattermost fails to invalidate previously generated password reset tokens when a new reset token...
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Record
GHSA-g328-hf66-x5p7- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Record
CVE-2023-3591- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Lack of previous password reset tokens on new token creation
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Record
CVE-2023-3591- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVBIT-mattermost-2023-3591 No score
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
- Record
BIT-mattermost-2023-3591- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mattermostBitnami |
7.8.0 up to 7.8.7, 7.9.0 up to 7.9.5, 7.10.0 up to 7.10.3 | 7.8.77.9.57.10.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3591 is a medium vulnerability (CVSS 4.8) in Mattermost, published July 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in mattermost 7.8.7.