Search
Find a vulnerability
Search criteria
536 vulnerabilities by Mattermost
CERTFR-2026-AVI-1212
Vulnerability from certfr_avis - Published: 2026-09-23 - Updated: 2026-09-23
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mattermost | Mattermost Server | Mattermost Server versions 11.9.x antérieures à 11.9.2 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.7.x antérieures à 11.7.11 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.10.x antérieures à 11.10.2 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.8.x antérieures à 11.8.6 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mattermost Server versions 11.9.x ant\u00e9rieures \u00e0 11.9.2",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.7.x ant\u00e9rieures \u00e0 11.7.11",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.10.x ant\u00e9rieures \u00e0 11.10.2",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.8.x ant\u00e9rieures \u00e0 11.8.6",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-96260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96260"
},
{
"name": "CVE-2026-95666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-95666"
},
{
"name": "CVE-2026-96259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96259"
}
],
"initial_release_date": "2026-09-23T00:00:00",
"last_revision_date": "2026-09-23T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1212",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mattermost Server. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mattermost Server",
"vendor_advisories": [
{
"published_at": "2026-09-22",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00775",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-22",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00776",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-22",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00771",
"url": "https://mattermost.com/security-updates/"
}
]
}
CERTFR-2026-AVI-1207
Vulnerability from certfr_avis - Published: 2026-09-21 - Updated: 2026-09-21
De multiples vulnérabilités ont été découvertes dans les produits Mattermost. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mattermost | Mattermost Server | Mattermost Server versions 11.9.x antérieures à 11.9.2 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.7.x antérieures à 11.7.11 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.10.x antérieures à 11.10.2 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.8.x antérieures à 11.8.6 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mattermost Server versions 11.9.x ant\u00e9rieures \u00e0 11.9.2",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.7.x ant\u00e9rieures \u00e0 11.7.11",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.10.x ant\u00e9rieures \u00e0 11.10.2",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.8.x ant\u00e9rieures \u00e0 11.8.6",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [],
"initial_release_date": "2026-09-21T00:00:00",
"last_revision_date": "2026-09-21T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1207",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mattermost. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mattermost",
"vendor_advisories": [
{
"published_at": "2026-09-18",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00768",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-18",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00732",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-18",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00774",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-18",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00734",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-18",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00769",
"url": "https://mattermost.com/security-updates/"
}
]
}
CERTFR-2026-AVI-1190
Vulnerability from certfr_avis - Published: 2026-09-16 - Updated: 2026-09-16
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mattermost | Mattermost Server | Mattermost Server versions 11.9.x antérieures à 11.9.2 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.7.x antérieures à 11.7.11 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.10.x antérieures à 11.10.2 | ||
| Mattermost | Mattermost Server | Mattermost Server versions antérieures à 10.11.23 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.8.x antérieures à 11.8.6 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mattermost Server versions 11.9.x ant\u00e9rieures \u00e0 11.9.2",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.7.x ant\u00e9rieures \u00e0 11.7.11",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.10.x ant\u00e9rieures \u00e0 11.10.2",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions ant\u00e9rieures \u00e0 10.11.23",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.8.x ant\u00e9rieures \u00e0 11.8.6",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-91181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91181"
}
],
"initial_release_date": "2026-09-16T00:00:00",
"last_revision_date": "2026-09-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1190",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-16T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mattermost Server. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mattermost Server",
"vendor_advisories": [
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00773",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00761",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00763",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00747",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00726",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00752",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00757",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00756",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00711",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00727",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00764",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00765",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00754",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00758",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00748",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00702",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00766",
"url": "https://mattermost.com/security-updates/"
}
]
}
CERTFR-2026-AVI-1128
Vulnerability from certfr_avis - Published: 2026-09-08 - Updated: 2026-09-15
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mattermost | Mattermost Server | Mattermost Server versions 11.8.x antérieures à 11.8.5 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 10.11.x antérieures à 10.11.23 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.7.x antérieures à 11.7.9 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.9.x antérieures à 11.9.1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mattermost Server versions 11.8.x ant\u00e9rieures \u00e0 11.8.5",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 10.11.x ant\u00e9rieures \u00e0 10.11.23",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.7.x ant\u00e9rieures \u00e0 11.7.9",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.9.x ant\u00e9rieures \u00e0 11.9.1",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-86349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86349"
},
{
"name": "CVE-2026-86348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86348"
}
],
"initial_release_date": "2026-09-08T00:00:00",
"last_revision_date": "2026-09-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1128",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-08T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE, modification des risques en cons\u00e9quence.",
"revision_date": "2026-09-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mattermost Server. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mattermost Server",
"vendor_advisories": [
{
"published_at": "2026-09-07",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00701",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-09-07",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00707",
"url": "https://mattermost.com/security-updates/"
}
]
}
CERTFR-2026-AVI-1098
Vulnerability from certfr_avis - Published: 2026-09-01 - Updated: 2026-09-15
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mattermost | Mattermost Server | Mattermost Server versions 11.8.x antérieures à 11.8.5 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.7.x antérieures à 11.7.8 | ||
| Mattermost | Mattermost Server | Mattermost Server versions 11.9.x antérieures à 11.9.1 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mattermost Server versions 11.8.x ant\u00e9rieures \u00e0 11.8.5",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.7.x ant\u00e9rieures \u00e0 11.7.8",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
},
{
"description": "Mattermost Server versions 11.9.x ant\u00e9rieures \u00e0 11.9.1",
"product": {
"name": "Mattermost Server",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-12985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12985"
},
{
"name": "CVE-2026-82920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-82920"
}
],
"initial_release_date": "2026-09-01T00:00:00",
"last_revision_date": "2026-09-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1098",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-01T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE, modification des risques en cons\u00e9quence.",
"revision_date": "2026-09-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mattermost Server. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mattermost Server",
"vendor_advisories": [
{
"published_at": "2026-08-31",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00724",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-08-31",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00700",
"url": "https://mattermost.com/security-updates/"
}
]
}
CERTFR-2026-AVI-1040
Vulnerability from certfr_avis - Published: 2026-08-18 - Updated: 2026-08-18
De multiples vulnérabilités ont été découvertes dans Mattermost Desktop App. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mattermost | Mattermost Desktop App | Mattermost Desktop App versions antérieures à 6.2.3 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mattermost Desktop App versions ant\u00e9rieures \u00e0 6.2.3",
"product": {
"name": "Mattermost Desktop App",
"vendor": {
"name": "Mattermost",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-75587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75587"
}
],
"initial_release_date": "2026-08-18T00:00:00",
"last_revision_date": "2026-08-18T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1040",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mattermost Desktop App. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Mattermost Desktop App",
"vendor_advisories": [
{
"published_at": "2026-08-17",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00717",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-08-17",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00716",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-08-17",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00698",
"url": "https://mattermost.com/security-updates/"
},
{
"published_at": "2026-08-17",
"title": "Bulletin de s\u00e9curit\u00e9 Mattermost MMSA-2026-00699",
"url": "https://mattermost.com/security-updates/"
}
]
}
CVE-2026-96260 (GCVE-0-2026-96260)
Vulnerability from cvelistv5 – Published: 2026-09-22 20:34 – Updated: 2026-09-23 15:06
VLAI
EPSS
VEX
Title
Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user
Summary
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 15:05 UTC
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.1
(semver)
Affected: 11.8.0 , ≤ 11.8.5 (semver) Affected: 11.7.0 , ≤ 11.7.10 (semver) Affected: 11.10.0 , ≤ 11.10.1 (semver) Unaffected: 11.11.0 Unaffected: 11.9.2 Unaffected: 11.8.6 Unaffected: 11.7.11 Unaffected: 11.10.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T15:05:56.037132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T15:06:07.254Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.1",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.5",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.10",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.10.1",
"status": "affected",
"version": "11.10.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.11.0"
},
{
"status": "unaffected",
"version": "11.9.2"
},
{
"status": "unaffected",
"version": "11.8.6"
},
{
"status": "unaffected",
"version": "11.7.11"
},
{
"status": "unaffected",
"version": "11.10.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alimursaliyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.1, 11.8.x \u003c= 11.8.5, 11.7.x \u003c= 11.7.10, 11.10.x \u003c= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint.. Mattermost Advisory ID: MMSA-2026-00775"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:34:49.141Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00775",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00775",
"defect": [
"https://mattermost.atlassian.net/browse/MM-70503"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-96260",
"datePublished": "2026-09-22T20:34:49.141Z",
"dateReserved": "2026-09-22T20:00:26.276Z",
"dateUpdated": "2026-09-23T15:06:07.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96259 (GCVE-0-2026-96259)
Vulnerability from cvelistv5 – Published: 2026-09-22 20:34 – Updated: 2026-09-23 13:10
VLAI
EPSS
VEX
Title
Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
Summary
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 13:10 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.1
(semver)
Affected: 11.8.0 , ≤ 11.8.5 (semver) Affected: 11.7.0 , ≤ 11.7.10 (semver) Affected: 11.10.0 , ≤ 11.10.1 (semver) Unaffected: 11.11.0 Unaffected: 11.9.2 Unaffected: 11.8.6 Unaffected: 11.7.11 Unaffected: 11.10.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T13:10:28.219588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T13:10:47.754Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.1",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.5",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.10",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.10.1",
"status": "affected",
"version": "11.10.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.11.0"
},
{
"status": "unaffected",
"version": "11.9.2"
},
{
"status": "unaffected",
"version": "11.8.6"
},
{
"status": "unaffected",
"version": "11.7.11"
},
{
"status": "unaffected",
"version": "11.10.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n1nj4sec"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.1, 11.8.x \u003c= 11.8.5, 11.7.x \u003c= 11.7.10, 11.10.x \u003c= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:34:20.872Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00776",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00776",
"defect": [
"https://mattermost.atlassian.net/browse/MM-70502"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-96259",
"datePublished": "2026-09-22T20:34:20.872Z",
"dateReserved": "2026-09-22T19:59:57.887Z",
"dateUpdated": "2026-09-23T13:10:47.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95666 (GCVE-0-2026-95666)
Vulnerability from cvelistv5 – Published: 2026-09-22 13:11 – Updated: 2026-09-22 13:57
VLAI
EPSS
VEX
Title
Unbounded post ID array in the bulk reactions endpoint allows denial of service
Summary
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 13:55 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.1
(semver)
Affected: 11.8.0 , ≤ 11.8.5 (semver) Affected: 11.7.0 , ≤ 11.7.10 (semver) Affected: 11.10.0 , ≤ 11.10.1 (semver) Unaffected: 11.11.0 Unaffected: 11.9.2 Unaffected: 11.8.6 Unaffected: 11.7.11 Unaffected: 11.10.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95666",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T13:55:15.216071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T13:57:00.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.1",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.5",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.10",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.10.1",
"status": "affected",
"version": "11.10.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.11.0"
},
{
"status": "unaffected",
"version": "11.9.2"
},
{
"status": "unaffected",
"version": "11.8.6"
},
{
"status": "unaffected",
"version": "11.7.11"
},
{
"status": "unaffected",
"version": "11.10.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "idr"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.1, 11.8.x \u003c= 11.8.5, 11.7.x \u003c= 11.7.10, 11.10.x \u003c= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}.. Mattermost Advisory ID: MMSA-2026-00771"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T13:11:13.798Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00771",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, 11.10.2 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00771",
"defect": [
"https://mattermost.atlassian.net/browse/MM-70177"
],
"discovery": "EXTERNAL"
},
"title": "Unbounded post ID array in the bulk reactions endpoint allows denial of service",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-95666",
"datePublished": "2026-09-22T13:11:13.798Z",
"dateReserved": "2026-09-22T13:09:02.237Z",
"dateUpdated": "2026-09-22T13:57:00.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12284 (GCVE-0-2026-12284)
Vulnerability from cvelistv5 – Published: 2026-09-17 15:11 – Updated: 2026-09-17 19:18
VLAI
EPSS
VEX
Title
Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
Summary
Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:18 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
0 , ≤ 6.2.2
(semver)
Unaffected: 6.3.0 Unaffected: 6.2.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:18:33.462460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:18:45.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "6.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.3.0"
},
{
"status": "unaffected",
"version": "6.2.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Juho Fors\u00e9n"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost Desktop App versions \u003c=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Mattermost Advisory ID: MMSA-2026-00699"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:11:52.297Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00699",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost Desktop App to versions 6.3.0, 6.2.3.0 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00699",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69153"
],
"discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
},
"title": "Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-12284",
"datePublished": "2026-09-17T15:11:52.297Z",
"dateReserved": "2026-06-15T14:05:20.532Z",
"dateUpdated": "2026-09-17T19:18:45.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75588 (GCVE-0-2026-75588)
Vulnerability from cvelistv5 – Published: 2026-09-17 15:09 – Updated: 2026-09-17 19:22
VLAI
EPSS
VEX
Title
Mattermost Desktop App plugin popout scheme validation bypass
Summary
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:21 UTC
CWE
- CWE-1287 - Improper Validation of Specified Type of Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
0 , ≤ 6.2.2
(semver)
Unaffected: 6.3.0 Unaffected: 6.2.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75588",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:21:58.878556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:22:50.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "6.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.3.0"
},
{
"status": "unaffected",
"version": "6.2.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Juho Fors\u00e9n"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost Desktop App versions \u003c=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Mattermost Advisory ID: MMSA-2026-00717"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "CWE-1287: Improper Validation of Specified Type of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:09:40.829Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00717",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost Desktop App to versions 6.3.0, 6.2.3.0 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00717",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69786"
],
"discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
},
"title": "Mattermost Desktop App plugin popout scheme validation bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-75588",
"datePublished": "2026-09-17T15:09:40.829Z",
"dateReserved": "2026-08-17T22:19:32.227Z",
"dateUpdated": "2026-09-17T19:22:50.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75025 (GCVE-0-2026-75025)
Vulnerability from cvelistv5 – Published: 2026-09-16 18:27 – Updated: 2026-09-17 18:35
VLAI
EPSS
VEX
Title
Mattermost Desktop local network access from server-rendered content
Summary
Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy. Mattermost Advisory ID: MMSA-2026-00698
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:34 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
0 , ≤ 6.2.2
(semver)
Unaffected: 6.3.0 Unaffected: 6.2.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75025",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:34:41.889353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:35:23.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "6.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.3.0"
},
{
"status": "unaffected",
"version": "6.2.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "game0v3r"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost Desktop App versions \u003c=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private network resources. Thanks to game0v3r for contributing to this improvement under the Mattermost responsible disclosure policy. Mattermost Advisory ID: MMSA-2026-00698"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:27:02.819Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00698",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost Desktop App to versions 6.3.0, 6.2.3.0 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00698",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69239"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost Desktop local network access from server-rendered content",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-75025",
"datePublished": "2026-09-16T18:27:02.819Z",
"dateReserved": "2026-08-17T14:33:41.253Z",
"dateUpdated": "2026-09-17T18:35:23.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91181 (GCVE-0-2026-91181)
Vulnerability from cvelistv5 – Published: 2026-09-14 21:21 – Updated: 2026-09-16 03:56
VLAI
EPSS
VEX
Title
Data Retention Teams Endpoint Leaks Private Team Invite ID
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 00:00 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T03:56:15.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0x7oda7123"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team\u0027s secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T21:21:47.436Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00702",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00702",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69359"
],
"discovery": "EXTERNAL"
},
"title": "Data Retention Teams Endpoint Leaks Private Team Invite ID",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-91181",
"datePublished": "2026-09-14T21:21:47.436Z",
"dateReserved": "2026-09-14T21:20:45.375Z",
"dateUpdated": "2026-09-16T03:56:15.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12985 (GCVE-0-2026-12985)
Vulnerability from cvelistv5 – Published: 2026-09-14 14:09 – Updated: 2026-09-15 03:56
VLAI
EPSS
VEX
Title
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string.. Mattermost Advisory ID: MMSA-2026-00700
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 00:00 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site (“Open Redirect”)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12985",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T03:56:02.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "aryangurjarf401a3"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string.. Mattermost Advisory ID: MMSA-2026-00700"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u201cOpen Redirect\u201d)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:09:53.799Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00700",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00700",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69360"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost DCR redirect URI allowlist bypass via improper URL component validation",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-12985",
"datePublished": "2026-09-14T14:09:53.799Z",
"dateReserved": "2026-06-23T11:43:37.353Z",
"dateUpdated": "2026-09-15T03:56:02.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82920 (GCVE-0-2026-82920)
Vulnerability from cvelistv5 – Published: 2026-09-14 13:59 – Updated: 2026-09-14 19:23
VLAI
EPSS
VEX
Title
Mattermost ABAC parent policy bypass via policy update endpoint
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.. Mattermost Advisory ID: MMSA-2026-00724
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:13 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:13:28.324125Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:23:01.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kiwi_71"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.. Mattermost Advisory ID: MMSA-2026-00724"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:59:01.993Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00724",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00724",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69781"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost ABAC parent policy bypass via policy update endpoint",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-82920",
"datePublished": "2026-09-14T13:59:01.993Z",
"dateReserved": "2026-08-31T11:19:09.113Z",
"dateUpdated": "2026-09-14T19:23:01.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86348 (GCVE-0-2026-86348)
Vulnerability from cvelistv5 – Published: 2026-09-14 13:52 – Updated: 2026-09-14 19:23
VLAI
EPSS
VEX
Title
MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
Summary
Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:13 UTC
CWE
- CWE-704 - Incorrect Type Conversion or Cast
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
<=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 , ≤ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0
(semver)
Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:13:36.957049Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:23:01.298Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "\u003c=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0",
"status": "affected",
"version": "\u003c=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alimursaliyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions \u003c=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-704",
"description": "CWE-704: Incorrect Type Conversion or Cast",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:52:24.602Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00701",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00701",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69361"
],
"discovery": "EXTERNAL"
},
"title": "MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-86348",
"datePublished": "2026-09-14T13:52:24.602Z",
"dateReserved": "2026-09-07T09:35:28.446Z",
"dateUpdated": "2026-09-14T19:23:01.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86349 (GCVE-0-2026-86349)
Vulnerability from cvelistv5 – Published: 2026-09-14 13:51 – Updated: 2026-09-14 19:23
VLAI
EPSS
VEX
Title
Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:13 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.8 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.9 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:13:43.392628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:23:01.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.8",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.9"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "tr66net"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.8, 10.11.x \u003c= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via a crafted post containing deeply nested blockquotes or list items.. Mattermost Advisory ID: MMSA-2026-00707"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:51:30.175Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00707",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.9, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00707",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69398"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-86349",
"datePublished": "2026-09-14T13:51:30.175Z",
"dateReserved": "2026-09-07T09:38:22.768Z",
"dateUpdated": "2026-09-14T19:23:01.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10556 (GCVE-0-2026-10556)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:46 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:04 UTC
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:04:06.098806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:44.241Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kamil-sawicki"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:46:01.186Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00693",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00693",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69073"
],
"discovery": "EXTERNAL"
},
"title": "Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-10556",
"datePublished": "2026-09-14T10:46:01.186Z",
"dateReserved": "2026-06-01T14:36:14.113Z",
"dateUpdated": "2026-09-14T11:19:44.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13417 (GCVE-0-2026-13417)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:44 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Boards plugin denial of service via unvalidated block fields.properties
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:03 UTC
CWE
- CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:03:53.719633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:44.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alimursaliyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:44:59.391Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00710",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00710",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69520"
],
"discovery": "EXTERNAL"
},
"title": "Boards plugin denial of service via unvalidated block fields.properties",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-13417",
"datePublished": "2026-09-14T10:44:59.391Z",
"dateReserved": "2026-06-26T11:40:33.086Z",
"dateUpdated": "2026-09-14T11:19:44.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9812 (GCVE-0-2026-9812)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:43 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Missing property field ownership validation in Playbooks run property update endpoint
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:03 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:03:43.239891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:44.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alimursaliyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:43:45.589Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00684",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00684",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69020"
],
"discovery": "EXTERNAL"
},
"title": "Missing property field ownership validation in Playbooks run property update endpoint",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-9812",
"datePublished": "2026-09-14T10:43:45.589Z",
"dateReserved": "2026-05-28T08:47:31.086Z",
"dateUpdated": "2026-09-14T11:19:44.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8821 (GCVE-0-2026-8821)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:42 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Playbooks run owner channel membership permission bypass
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Mattermost Advisory ID: MMSA-2026-00677
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:03:09.855978Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:44.842Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ilent0"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field.. Mattermost Advisory ID: MMSA-2026-00677"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:42:42.672Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00677",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00677",
"defect": [
"https://mattermost.atlassian.net/browse/MM-68695"
],
"discovery": "EXTERNAL"
},
"title": "Playbooks run owner channel membership permission bypass",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-8821",
"datePublished": "2026-09-14T10:42:42.672Z",
"dateReserved": "2026-05-18T09:19:00.475Z",
"dateUpdated": "2026-09-14T11:19:44.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5132 (GCVE-0-2026-5132)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:41 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Unbounded zlib decompression in Calls SDP WebSocket messages
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:03 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:03:03.373134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:45.000Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "daw10"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID: MMSA-2026-00643"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:41:42.387Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00643",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00643",
"defect": [
"https://mattermost.atlassian.net/browse/MM-68130"
],
"discovery": "EXTERNAL"
},
"title": "Unbounded zlib decompression in Calls SDP WebSocket messages",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-5132",
"datePublished": "2026-09-14T10:41:42.387Z",
"dateReserved": "2026-03-30T09:58:00.256Z",
"dateUpdated": "2026-09-14T11:19:45.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15814 (GCVE-0-2026-15814)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:39 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Uploading a crafted image causes excessive memory allocation in the Mattermost Server
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:02 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:02:52.669341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:45.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "alimursaliyev"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a specially crafted image as a profile picture, channel file attachment, team icon, or custom brand image. Mattermost Advisory ID: MMSA-2026-00719"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:39:45.714Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00719",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00719",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69809"
],
"discovery": "EXTERNAL"
},
"title": "Uploading a crafted image causes excessive memory allocation in the Mattermost Server",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-15814",
"datePublished": "2026-09-14T10:39:45.714Z",
"dateReserved": "2026-07-15T10:53:51.646Z",
"dateUpdated": "2026-09-14T11:19:45.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-10542 (GCVE-0-2026-10542)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:37 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Playbooks channel action update validation issue
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:02 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:02:43.768854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:45.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "minghseinyuc86595"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:37:32.147Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00692",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00692",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69069"
],
"discovery": "EXTERNAL"
},
"title": "Playbooks channel action update validation issue",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-10542",
"datePublished": "2026-09-14T10:37:32.147Z",
"dateReserved": "2026-06-01T12:34:54.592Z",
"dateUpdated": "2026-09-14T11:19:45.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14344 (GCVE-0-2026-14344)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:33 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Inconsistent authorization checks in Mattermost Boards endpoints
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:02 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14344",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:02:35.335599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:45.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "c4b8a133-e345-4bbe-9a44-d1ef0938de51"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:33:54.215Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00715",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00715",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69621"
],
"discovery": "EXTERNAL"
},
"title": "Inconsistent authorization checks in Mattermost Boards endpoints",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-14344",
"datePublished": "2026-09-14T10:33:54.215Z",
"dateReserved": "2026-07-01T14:33:22.302Z",
"dateUpdated": "2026-09-14T11:19:45.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12882 (GCVE-0-2026-12882)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:30 – Updated: 2026-09-14 11:19
VLAI
EPSS
VEX
Title
Mattermost Markdown autolink parsing denial of service
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 11:02 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12882",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T11:02:14.110168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:19:45.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Korczynski"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:30:39.482Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00703",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00703",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69407"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost Markdown autolink parsing denial of service",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-12882",
"datePublished": "2026-09-14T10:30:39.482Z",
"dateReserved": "2026-06-22T10:27:00.877Z",
"dateUpdated": "2026-09-14T11:19:45.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11993 (GCVE-0-2026-11993)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:29 – Updated: 2026-09-14 19:36
VLAI
EPSS
VEX
Title
Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:36 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11993",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:36:23.391913Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:36:34.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "JG Heithcock"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:29:19.934Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00696",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00696",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69217"
],
"discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
},
"title": "Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-11993",
"datePublished": "2026-09-14T10:29:19.934Z",
"dateReserved": "2026-06-11T14:54:55.079Z",
"dateUpdated": "2026-09-14T19:36:34.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14259 (GCVE-0-2026-14259)
Vulnerability from cvelistv5 – Published: 2026-09-14 10:26 – Updated: 2026-09-14 19:36
VLAI
EPSS
VEX
Title
Board archive import bypasses team board creation permissions
Summary
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
11.9.0 , ≤ 11.9.0
(semver)
Affected: 11.8.0 , ≤ 11.8.4 (semver) Affected: 11.7.0 , ≤ 11.7.7 (semver) Affected: 10.11.0 , ≤ 10.11.22 (semver) Unaffected: 11.10.0 Unaffected: 11.9.1 Unaffected: 11.8.5 Unaffected: 11.7.8 Unaffected: 10.11.23 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:35:56.710286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:36:08.766Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "11.9.0",
"status": "affected",
"version": "11.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.8.4",
"status": "affected",
"version": "11.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.7",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.11.22",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.10.0"
},
{
"status": "unaffected",
"version": "11.9.1"
},
{
"status": "unaffected",
"version": "11.8.5"
},
{
"status": "unaffected",
"version": "11.7.8"
},
{
"status": "unaffected",
"version": "10.11.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "angelatanasov5ac9f8"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T10:26:41.916Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00712",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00712",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69582"
],
"discovery": "EXTERNAL"
},
"title": "Board archive import bypasses team board creation permissions",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-14259",
"datePublished": "2026-09-14T10:26:41.916Z",
"dateReserved": "2026-06-30T16:00:56.371Z",
"dateUpdated": "2026-09-14T19:36:08.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75587 (GCVE-0-2026-75587)
Vulnerability from cvelistv5 – Published: 2026-08-17 22:09 – Updated: 2026-08-18 14:20
VLAI
EPSS
VEX
Title
Plaintext pre-auth secret exposure via Desktop App diagnostics report
Summary
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:19 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
0 , ≤ 6.2.2
(semver)
Unaffected: 6.3.0 Unaffected: 6.2.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75587",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:19:44.433262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:20:26.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "6.2.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.3.0"
},
{
"status": "unaffected",
"version": "6.2.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Juho Fors\u00e9n"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost Desktop App versions \u003c=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user\u0027s diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T22:09:49.590Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00716",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost Desktop App to versions 6.3.0, 6.2.3.0 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00716",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69787"
],
"discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
},
"title": "Plaintext pre-auth secret exposure via Desktop App diagnostics report",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-75587",
"datePublished": "2026-08-17T22:09:49.590Z",
"dateReserved": "2026-08-17T22:07:53.714Z",
"dateUpdated": "2026-08-18T14:20:26.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9693 (GCVE-0-2026-9693)
Vulnerability from cvelistv5 – Published: 2026-08-17 22:07 – Updated: 2026-08-18 14:21
VLAI
EPSS
VEX
Title
Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
Summary
Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 14:20 UTC
CWE
- CWE-459 - Incomplete Cleanup
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://mattermost.com/security-updates | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mattermost | Mattermost |
Affected:
10.11.0 , ≤ 10.11.20
(semver)
Affected: 11.7.0 , ≤ 11.7.5 (semver) Unaffected: 11.9.0 Unaffected: 10.11.21 Unaffected: 11.7.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9693",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T14:20:52.913739Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T14:21:04.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mattermost",
"vendor": "Mattermost",
"versions": [
{
"lessThanOrEqual": "10.11.20",
"status": "affected",
"version": "10.11.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.7.5",
"status": "affected",
"version": "11.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "11.9.0"
},
{
"status": "unaffected",
"version": "10.11.21"
},
{
"status": "unaffected",
"version": "11.7.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kiwi_71"
}
],
"descriptions": [
{
"lang": "en",
"value": "Mattermost versions 10.11.x \u003c= 10.11.20, 11.7.x \u003c= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459: Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T22:07:12.958Z",
"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"shortName": "Mattermost"
},
"references": [
{
"name": "MMSA-2026-00682",
"tags": [
"vendor-advisory"
],
"url": "https://mattermost.com/security-updates"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Mattermost to versions 11.9.0, 10.11.21, 11.7.6 or higher."
}
],
"source": {
"advisory": "MMSA-2026-00682",
"defect": [
"https://mattermost.atlassian.net/browse/MM-69006"
],
"discovery": "EXTERNAL"
},
"title": "Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
"assignerShortName": "Mattermost",
"cveId": "CVE-2026-9693",
"datePublished": "2026-08-17T22:07:12.958Z",
"dateReserved": "2026-05-27T10:58:39.051Z",
"dateUpdated": "2026-08-18T14:21:04.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}