Summary
Ein authentisierter Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um falsche Informationen anzuzeigen, Informationen offenzulegen, Sicherheitskontrollen zu umgehen und eine Denial-of-Service-Situation zu erzeugen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 19
-
High 7.6
MS Teams plugin sensitive config values not properly masked in support packets
Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606
-
High 7.5
DoS attack via login attempts with multi-megabyte passwords
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long passwords, which allows an attacker to overload the server CPU and memory via executing login attempts with multi-megabyte passwords. Mattermost Advi…
-
Medium 6.6
Admin RCE via Malicious Plugin Upload on CI Test Instances
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensi…
-
Medium 5.8
DoS in Calls plugin via malformed msgpack in websocket request.
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array lengths which allows malicious user to cause OOM errors and crash the server via sending corrupted msgpack frames within websocket messages t…
-
Medium 5.3
Denial of Service via Unbounded Memory Allocation in Integration Actions
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a…
-
Medium 4.3
Permalink Preview Information Disclosure After Permission Revocation
Mattermost versions 10.11.x <= 10.11.10 Fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin..…
-
Medium 4.3
Private channel enumeration via /mute slash command
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command which allows an authenticated team member to enumerate private channels they are not authorized to know about vi…
-
Medium 4.3
SSRF bypass via IPv4-mapped IPv6 literals
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which allows an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals …
-
Medium 4.3
WebSocket Message Spoofing via Permalink Embed Manipulation
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update A…
-
Medium 4.3
Unauthorized channel enumeration in private teams after member removal
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a removed team member to enumerate all public channels within a private team via the channel search API …
-
Medium 4.3CVE-2026-2461 Public exploit
Missing authorization check allows unauthorized modification of other users' comments on a board
Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisor…
-
Medium 4.3
Unauthorized access to invite ID during team creation
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during t…
-
Medium 4.3
Guest users can bypass read permissions via search API
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Matt…
-
Medium 4.3
Memory Exhaustion via Malformed DOC File Upload
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially craf…
-
Medium 4.3
Denial of service via malformed User-Agent header in getBrowserVersion
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: M…
-
Medium 4.3
Memory Exhaustion via Malformed PSD File Upload
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a speciall…
-
Medium 4.3
Permission Bypass in Playbook Run Creation
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2 fail to verify run_create permission for empty playbookId, which allows team members to create unauthorized runs via the playbook run API. Mattermost Advisory ID: MMSA-2025-00542
-
Low 3.8
Team Admin Privilege Escalation to Demote Members to Guest
Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531
-
Low 3.1
Password Change Bypass via Auth Switch Endpoint
Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated attacker to change account password without confirmation via falsely claiming a different auth provide…
Revision history
-
#5
CVE-2026-2476, CVE-2026-2461 ergänzt
-
#4
Neue Informationen von Mattermost aufgenommen
-
#3
Referenz(en) aufgenommen: EUVD-2026-12411, EUVD-2026-12409, EUVD-2026-12385, EUVD-2026-12430, EUVD-2026-12405, EUVD-2026-12516, EUVD-2026-12510, EUVD-2026-12443, EUVD-2026-12439, EUVD-2026-12416, EUVD-2026-12518, EUVD-2026-12512, EUVD-2026-12441, EUVD-2026-12437, EUVD-2026-12383, EUVD-2026-12417, EUVD-2026-12413, EUVD-2026-12407
-
#2
Referenz(en) aufgenommen: EUVD-2026-9174
-
#1
Initiale Fassung
References
-
Mattermost Security Updates vom 2026-02-15
https://mattermost.com/security-updates/#desktop
-
Mattermost Security Updates vom 2026-02-15
https://mattermost.com/security-updates/#plugins
-
Mattermost Security Updates vom 2026-02-15
https://mattermost.com/security-updates/#server