CVE-2023-2788: 
Mattermost vulnerability analysis and mitigation

Mattermost contains a vulnerability (CVE-2023-2788) where the system fails to properly verify admin user account status during OAuth2 flow. This vulnerability was discovered in versions 7.1.0-7.1.9, 7.8.0-7.8.4, 7.9.0-7.9.3, and 7.10.0 of Mattermost (NVD).

The vulnerability allows an attacker with admin privileges to maintain persistent access to Mattermost by obtaining an OAuth2 access token while their account is deactivated. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N by NIST, and a score of 6.2 (Medium) by Mattermost with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L (NVD).

If exploited, this vulnerability allows deactivated admin accounts to retain unauthorized access to the Mattermost system through OAuth2 tokens, potentially compromising system security and data confidentiality (NVD).

The vulnerability requires high privileges (admin access) to exploit, but can be executed remotely with no user interaction required. The attack complexity is considered low according to NIST's assessment (NVD).

Organizations should upgrade to the latest patched versions of Mattermost. The vulnerability has been addressed in subsequent releases after the affected versions 7.1.9, 7.8.4, 7.9.3, and 7.10.0 (Mattermost Security).